Return 400 for missing /api/serialize IDs (#1272)

### Summary

When two or more sibling instances share the same `Name` and
`ClassName`, Rojo's reconciler previously paired them with their
server-side counterparts purely by child order (first-unvisited match in
`GetChildren()` order). If the workspace child order ever diverged from
the server's, the wrong instance got paired so each duplicate could
inherit a sibling's properties.

This is the root of the #1257 bug: the welded parts would oscillate
between positions on each connect/disconnect because hydration kept
mis-pairing them. (#1265 stopped the sync fallback from scrambling child
order in the first place but this PR makes hydration robust even when
order *does* diverge.)

This PR makes `hydrate` break ties by comparing properties: when several
existing children match on `Name`+`ClassName`, it scores each candidate
by how many of the virtual instance's properties match the candidate's
live values, and picks the best. Order remains the tiebreak when scores
are equal, so behavior is unchanged for uniquely-named instances and for
indistinguishable siblings.

### Changes

- `trueEquals.lua`: extracted verbatim from `diff.lua` (the fuzzy
value-equality helper) so it can be shared. No behavior change;
`diff.lua` now requires it.
- `countMatchingProperties.lua`: added
`countMatchingProperties(instance, virtualInstance, instanceMap) ->
number`. Skips `Ref` properties (the instanceMap isn't fully built
mid-hydrate, so refs can't be decoded reliably, and they're a poor
disambiguator anyway) and any property that can't be read or decoded.
- `hydrate.lua`: See details below.

### Hydrate Changes

This touches `hydrate`, which runs over the whole tree on every
connect/resync, so I want state clearly that **the common path is faster
than before, not slower** even for parents with thousands of children!

The old algorithm was a nested scan: for each of `V` virtual children,
scan existing children until the first unvisited `Name`+`ClassName`
match. Two costs stand out:
- A `pcall` (to guard DataModel permission errors) ran on every
comparison (up to `V*E` `pcall`s per parent).
- Even for in-order trees the re-scanning of the visited prefix made it
`O(V^2)`.

The new algorithm does a single bucketing pass, then `O(1)` lookups:
1. One `O(E)` pass groups existing children into nested
`buckets[name][className]` tables. This runs exactly `E` `pcall`s total
(one per child), down from the `V*E` worst case.
2. Each virtual child does an `O(1)` bucket lookup to find its
candidates.
3. A per-bucket cursor skips already-paired children, so order-based
matching is amortized `O(1)` per child instead of rescanning.

| Scenario | Old | New |
| ------------------------------------------------ |
--------------------------------------- |
--------------------------------------------- |
| Unique-named children (typical, incl. thousands) | `O(V^2)`, plus up
to `V*E` pcalls | `O(V + E)`, plus exactly `E` pcalls |
| `C <= 32` candidates | `O(C^2)` | `O(P * C^2)` scoring |
| `C > 32` candidates | `O(C^2)` | `O(C)` |

Property scoring (`getProperty`/`decodeValue`/`trueEquals`) is the only
new expense, and it's gated two ways:
- It runs only when a `Name`+`ClassName` group has >=2 candidates (i.e.
never for uniquely-named instances).
- A cap, `MAX_CANDIDATES_TO_SCORE = 32`, means scoring only kicks in
once a group has <=32 unvisited candidates. A folder of thousands of
identically-named parts therefore does not trigger scoring; it falls
back to the original order-based pairing. The worst-case added scoring
work is bounded to roughly `32^2` property comparisons per group,
independent of group size.

So overall this is faster when you have unique names or many children.
It is slower but more robust when you have small groups of duplicate
names. Memory usage is increased as it creates the candidate buckets.

.github/workflows/release.yml

@@ -44,6 +44,13 @@ jobs:
         with:
           name: Rojo.rbxm
           path: Rojo.rbxm
+      
+      - name: Upload Plugin to Roblox
+        env:
+          RBX_API_KEY: ${{ secrets.PLUGIN_UPLOAD_TOKEN }}
+          RBX_UNIVERSE_ID: ${{ vars.PLUGIN_CI_PLACE_ID }}
+          RBX_PLACE_ID: ${{ vars.PLUGIN_CI_UNIVERSE_ID }}
+        run: lune run upload-plugin Rojo.rbxm
 
   build:
     needs: ["create-release"]

.gitmodules

@@ -16,3 +16,9 @@
 [submodule "plugin/Packages/Highlighter"]
 	path = plugin/Packages/Highlighter
 	url = https://github.com/boatbomber/highlighter.git
+[submodule "plugin/Packages/msgpack-luau"]
+	path = plugin/Packages/msgpack-luau
+	url = https://github.com/cipharius/msgpack-luau/
+[submodule ".lune/opencloud-execute"]
+	path = .lune/opencloud-execute
+	url = https://github.com/Dekkonot/opencloud-luau-execute-lune.git

.lune/.config.luau

@@ -0,0 +1,8 @@
+return {
+	luau = {
+		languagemode = "strict",
+		aliases = {
+			lune = "~/.lune/.typedefs/0.10.4/",
+		},
+	},
+}

.lune/scripts/plugin-upload.luau

@@ -0,0 +1,51 @@
+local args: any = ...
+assert(args, "no arguments passed to script")
+
+local input: buffer = args.BinaryInput
+
+local AssetService = game:GetService("AssetService")
+local SerializationService = game:GetService("SerializationService")
+local EncodingService = game:GetService("EncodingService")
+
+local input_hash: buffer = EncodingService:ComputeBufferHash(input, Enum.HashAlgorithm.Sha256)
+local hex_hash: { string } = table.create(buffer.len(input_hash))
+for i = 0, buffer.len(input_hash) - 1 do
+	table.insert(hex_hash, string.format("%02x", buffer.readu8(input_hash, i)))
+end
+
+print(`Deserializing plugin file (size: {buffer.len(input)} bytes, hash: {table.concat(hex_hash, "")})`)
+local plugin = SerializationService:DeserializeInstancesAsync(input)[1]
+
+local UploadDetails = require(plugin.UploadDetails) :: any
+local PLUGIN_ID = UploadDetails.assetId
+local PLUGIN_NAME = UploadDetails.name
+local PLUGIN_DESCRIPTION = UploadDetails.description
+local PLUGIN_CREATOR_ID = UploadDetails.creatorId
+local PLUGIN_CREATOR_TYPE = UploadDetails.creatorType
+
+assert(typeof(PLUGIN_ID) == "number", "UploadDetails did not contain a number field 'assetId'")
+assert(typeof(PLUGIN_NAME) == "string", "UploadDetails did not contain a string field 'name'")
+assert(typeof(PLUGIN_DESCRIPTION) == "string", "UploadDetails did not contain a string field 'description'")
+assert(typeof(PLUGIN_CREATOR_ID) == "number", "UploadDetails did not contain a number field 'creatorId'")
+assert(typeof(PLUGIN_CREATOR_TYPE) == "string", "UploadDetails did not contain a string field 'creatorType'")
+assert(
+	Enum.AssetCreatorType:FromName(PLUGIN_CREATOR_TYPE) ~= nil,
+	"UploadDetails field 'creatorType' was not a valid member of Enum.AssetCreatorType"
+)
+
+print(`Uploading to {PLUGIN_ID}`)
+print(`Plugin Name: {PLUGIN_NAME}`)
+print(`Plugin Description: {PLUGIN_DESCRIPTION}`)
+
+local result, version_or_err = AssetService:CreateAssetVersionAsync(plugin, Enum.AssetType.Plugin, PLUGIN_ID, {
+	["Name"] = PLUGIN_NAME,
+	["Description"] = PLUGIN_DESCRIPTION,
+	["CreatorId"] = PLUGIN_CREATOR_ID,
+	["CreatorType"] = Enum.AssetCreatorType:FromName(PLUGIN_CREATOR_TYPE),
+})
+
+if result ~= Enum.CreateAssetResult.Success then
+	error(`Plugin failed to upload because: {result.Name} - {version_or_err}`)
+end
+
+print(`Plugin uploaded successfully. New version is {version_or_err}.`)

.lune/upload-plugin.luau

@@ -0,0 +1,78 @@
+local fs = require("@lune/fs")
+local process = require("@lune/process")
+local stdio = require("@lune/stdio")
+
+local luau_execute = require("./opencloud-execute")
+
+local UNIVERSE_ID = process.env["RBX_UNIVERSE_ID"]
+local PLACE_ID = process.env["RBX_PLACE_ID"]
+
+local version_string = fs.readFile("plugin/Version.txt")
+local versions = { string.match(version_string, "^v?(%d+)%.(%d+)%.(%d+)(.*)$") }
+if versions[4] ~= "" then
+	print("This release is a pre-release. Skipping uploading plugin.")
+	process.exit(0)
+end
+
+local plugin_path = process.args[1]
+assert(
+	typeof(plugin_path) == "string",
+	"no plugin path provided, expected usage is `lune run upload-plugin [PATH TO RBXM]`."
+)
+
+-- For local testing
+if process.env["CI"] ~= "true" then
+	local rojo = process.exec("rojo", { "build", "plugin.project.json", "--output", plugin_path })
+	if not rojo.ok then
+		stdio.ewrite("plugin upload failed because: could not build plugin.rbxm\n\n")
+		stdio.ewrite(rojo.stderr)
+		stdio.ewrite("\n")
+		process.exit(1)
+	end
+else
+	assert(fs.isFile(plugin_path), `Plugin file did not exist at {plugin_path}`)
+end
+local plugin_content = fs.readFile(plugin_path)
+
+local engine_script = fs.readFile(".lune/scripts/plugin-upload.luau")
+
+print("Creating task to upload plugin")
+local task = luau_execute.create_task_latest(UNIVERSE_ID, PLACE_ID, engine_script, 300, false, plugin_content)
+
+print("Waiting for task to finish")
+local success = luau_execute.await_finish(task)
+if not success then
+	local error = luau_execute.get_error(task)
+	assert(error, "could not fetch error from task")
+	stdio.ewrite("plugin upload failed because: task did not finish successfully\n\n")
+	stdio.ewrite(error.code)
+	stdio.ewrite("\n")
+	stdio.ewrite(error.message)
+	stdio.ewrite("\n")
+	process.exit(1)
+end
+
+print("Output from task:\n")
+for _, log in luau_execute.get_structured_logs(task) do
+	if log.messageType == "ERROR" then
+		stdio.write(stdio.color("red"))
+		stdio.write(log.message)
+		stdio.write("\n")
+		stdio.write(stdio.color("reset"))
+	elseif log.messageType == "INFO" then
+		stdio.write(stdio.color("cyan"))
+		stdio.write(log.message)
+		stdio.write("\n")
+		stdio.write(stdio.color("reset"))
+	elseif log.messageType == "WARNING" then
+		stdio.write(stdio.color("yellow"))
+		stdio.write(log.message)
+		stdio.write("\n")
+		stdio.write(stdio.color("reset"))
+	else
+		stdio.write(stdio.color("reset"))
+		stdio.write(log.message)
+		stdio.write("\n")
+		stdio.write(stdio.color("reset"))
+	end
+end

CHANGELOG.md

@@ -30,15 +30,40 @@ Making a new release? Simply add the new header with the version and date undern
 -->
 
 ## Unreleased
-* Fixed a bug caused by having reference properties (such as `ObjectValue.Value`) that point to an Instance not included in syncback. ([#1179])
-* Implemented support for the "name" property in meta/model JSON files. ([#1187])
-* Fixed instance replacement fallback failing when too many instances needed to be replaced. ([#1192])
-* Fixed a bug where MacOS paths weren't being handled correctly. ([#1201])
 
+* `inf` and `nan` values in properties are now synced ([#1176])
+* Fixed a bug caused by having reference properties (such as `ObjectValue.Value`) that point to an Instance not included in syncback. ([#1179])
+* Fixed instance replacement fallback failing when too many instances needed to be replaced. ([#1192])
+* Added actors and bindable/remote event/function variants to be synced back as JSON files. ([#1199])
+* Fixed a bug where MacOS paths weren't being handled correctly. ([#1201])
+* Fixed a bug where the notification timeout thread would fail to cancel on unmount ([#1211])
+* Added a "Forget" option to the sync reminder notification to avoid being reminded for that place in the future ([#1215])
+* Improves relative path calculation for sourcemap generation to avoid issues with Windows UNC paths. ([#1217])
+* Fixed missing support for init.plugin.lua and init.plugin.luau. ([#1252])
+* Add support for gitignore-style negation in `globIgnorePaths` and syncback's `ignorePaths` ([#1256])
+* Fixed the sync fallback scrambling sibling order; replacements are now re-parented ancestors-first and in their original child order. ([#1265])
+* Instances that share a name and class are now robustly matched on resync by comparing their properties, instead of relying on child order alone. ([#1266])
+* Rojo now reports a clear error instead of panicking in several cases, including when the `serve` port is already in use, when a synced file is read-only or locked, when the filesystem watcher can't be created, and when the working directory is inaccessible. ([#1267])
+* Fixed `/api/serialize` returning success when a requested instance ID is missing from the serve session tree. ([#1272])
+* `rojo serve` now validates the `Host`/`Origin` headers to protect the local/private server against DNS rebinding, gates `/api/open` to local clients, and warns when bound to a network-reachable address. The accepted hosts can be extended with the `--allowed-hosts` option or a project's `serveAllowedHosts` field, for example to reach a network-exposed server by hostname. ([#1270])
+* Fixed syncback not removing stale `$properties` entries when Studio resets a property to its engine default. ([#1244])
+
+[#1176]: https://github.com/rojo-rbx/rojo/pull/1176
 [#1179]: https://github.com/rojo-rbx/rojo/pull/1179
-[#1187]: https://github.com/rojo-rbx/rojo/pull/1187
 [#1192]: https://github.com/rojo-rbx/rojo/pull/1192
+[#1199]: https://github.com/rojo-rbx/rojo/pull/1199
 [#1201]: https://github.com/rojo-rbx/rojo/pull/1201
+[#1211]: https://github.com/rojo-rbx/rojo/pull/1211
+[#1215]: https://github.com/rojo-rbx/rojo/pull/1215
+[#1217]: https://github.com/rojo-rbx/rojo/pull/1217
+[#1252]: https://github.com/rojo-rbx/rojo/pull/1252
+[#1256]: https://github.com/rojo-rbx/rojo/pull/1256
+[#1265]: https://github.com/rojo-rbx/rojo/pull/1265
+[#1266]: https://github.com/rojo-rbx/rojo/pull/1266
+[#1267]: https://github.com/rojo-rbx/rojo/pull/1267
+[#1272]: https://github.com/rojo-rbx/rojo/pull/1272
+[#1270]: https://github.com/rojo-rbx/rojo/pull/1270
+[#1244]: https://github.com/rojo-rbx/rojo/pull/1244
 
 ## [7.7.0-rc.1] (November 27th, 2025)
 

CONTRIBUTING.md

@@ -13,11 +13,27 @@ Code contributions are welcome for features and bugs that have been reported in
 
 You'll want these tools to work on Rojo:
 
-* Latest stable Rust compiler
-* Latest stable [Rojo](https://github.com/rojo-rbx/rojo)
+* Rust 1.88 or newer
+  * Rustfmt and Clippy are used for code formatting and linting.
 * [Rokit](https://github.com/rojo-rbx/rokit)
 * [Luau Language Server](https://github.com/JohnnyMorganz/luau-lsp) (Only needed if working on the Studio plugin.)
 
+Rokit installs the pinned Rojo, Selene, StyLua, Lune, and run-in-roblox versions listed in [`rokit.toml`](rokit.toml):
+
+```bash
+rokit install
+```
+
+Before opening a pull request, run the relevant checks:
+
+```bash
+cargo test
+cargo fmt -- --check
+cargo clippy
+stylua --check plugin/src
+selene plugin/src
+```
+
 When working on the Studio plugin, we recommend using this command to automatically rebuild the plugin when you save a change:
 
 *(Make sure you've enabled the Studio setting to reload plugins on file change!)*
@@ -28,7 +44,7 @@ bash scripts/watch-build-plugin.sh
 
 You can also run the plugin's unit tests with the following:
 
-*(Make sure you have `run-in-roblox` installed first!)*
+*(If you are not using Rokit, make sure you have `run-in-roblox` installed first!)*
 
 ```bash
 bash scripts/unit-test-plugin.sh
@@ -48,27 +64,27 @@ Please file issues and we'll try to help figure out what the best way forward is
 
 ## Local Development Gotchas
 
-If your build fails with "Error: failed to open file `D:\code\rojo\plugin\modules\roact\src`" you need to update your Git submodules.
+If your build fails with an error about a missing path under `plugin/Packages`, such as `plugin/Packages/Roact`, you need to update your Git submodules.
 Run the command and try building again: `git submodule update --init --recursive`.
 
 ## Pushing a Rojo Release
-The Rojo release process is pretty manual right now. If you need to do it, here's how:
+The Rojo release process is driven by the GitHub Actions release workflow. If you need to do it, here's how:
 
 1. Bump server version in [`Cargo.toml`](Cargo.toml)
-2. Bump plugin version in [`plugin/src/Config.lua`](plugin/src/Config.lua)
-3. Run `cargo test` to update `Cargo.lock` and run tests
+2. Bump plugin version in [`plugin/Version.txt`](plugin/Version.txt)
+   * The build checks that the Cargo and plugin versions match.
+3. Run `cargo test` to update `Cargo.lock` after the version bump and run tests
 4. Update [`CHANGELOG.md`](CHANGELOG.md)
 5. Commit!
     * `git add . && git commit -m "Release vX.Y.Z"`
 6. Tag the commit
     * `git tag vX.Y.Z`
-7. Publish the CLI
-    * `cargo publish`
-8. Publish the Plugin
-    * `cargo run -- upload plugin --asset_id 6415005344`
-9. Push commits and tags
+7. Push commits and tags
     * `git push && git push --tags`
+8. Wait for the GitHub Actions release workflow to create the draft release and upload CLI/plugin artifacts
+9. Publish the CLI crate
+    * `cargo publish`
 10. Copy GitHub release content from previous release
     * Update the leading text with a summary about the release
     * Paste the changelog notes (as-is!) from [`CHANGELOG.md`](CHANGELOG.md)
-    * Write a small summary of each major feature
+    * Write a small summary of each major feature

Cargo.lock

@@ -1520,6 +1520,12 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pathdiff"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -2068,6 +2074,7 @@ dependencies = [
  "num_cpus",
  "opener",
  "paste",
+ "pathdiff",
  "pretty_assertions",
  "profiling",
  "rayon",
@@ -2078,10 +2085,12 @@ dependencies = [
  "rbx_xml",
  "reqwest",
  "ritz",
+ "rmp-serde",
  "roblox_install",
  "rojo-insta-ext",
  "semver",
  "serde",
+ "serde_bytes",
  "serde_json",
  "serde_yaml",
  "strum",
@@ -2222,6 +2231,16 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_cbor"
 version = "0.11.2"

Cargo.toml

@@ -100,10 +100,13 @@ clap = { version = "3.2.25", features = ["derive"] }
 profiling = "1.0.15"
 yaml-rust2 = "0.10.3"
 data-encoding = "2.8.0"
+pathdiff = "0.2.3"
 
 blake3 = "1.5.0"
 float-cmp = "0.9.0"
 indexmap = { version = "2.10.0", features = ["serde"] }
+rmp-serde = "1.3.0"
+serde_bytes = "0.11.19"
 
 [target.'cfg(windows)'.dependencies]
 winreg = "0.10.1"
@@ -122,7 +125,7 @@ semver = "1.0.22"
 rojo-insta-ext = { path = "crates/rojo-insta-ext" }
 
 criterion = "0.3.6"
-insta = { version = "1.36.1", features = ["redactions", "yaml"] }
+insta = { version = "1.36.1", features = ["redactions", "yaml", "json"] }
 paste = "1.0.14"
 pretty_assertions = "1.4.0"
 serde_yaml = "0.8.26"

README.md

@@ -25,12 +25,11 @@ Rojo enables:
 * Versioning your game, library, or plugin using Git or another VCS
 * Streaming `rbxmx` and `rbxm` models into your game in real time
 * Packaging and deploying your project to Roblox.com from the command line
+* Pulling Instances from Roblox place and model files back into an existing Rojo project with `rojo syncback`
 
-In the future, Rojo will be able to:
+Rojo also has an optional two-way sync setting in the Studio plugin for syncing supported Studio edits back to the filesystem.
 
-* Sync instances from Roblox Studio to the filesystem
-* Automatically convert your existing game to work with Rojo
-* Import custom instances like MoonScript code
+Some workflows, like fully automatic conversion of every existing game into a Rojo project, are still limited and may require manual project configuration.
 
 ## [Documentation](https://rojo.space/docs)
 Documentation is hosted in the [rojo.space repository](https://github.com/rojo-rbx/rojo.space).

build.rs

@@ -30,6 +30,11 @@ fn snapshot_from_fs_path(path: &Path) -> io::Result<VfsSnapshot> {
                 continue;
             }
 
+            // Ignore images in msgpack-luau because they aren't UTF-8 encoded.
+            if file_name.ends_with(".png") {
+                continue;
+            }
+
             let child_snapshot = snapshot_from_fs_path(&entry.path())?;
             children.push((file_name, child_snapshot));
         }
@@ -70,6 +75,7 @@ fn main() -> Result<(), anyhow::Error> {
             "src" => snapshot_from_fs_path(&plugin_dir.join("src"))?,
             "Packages" => snapshot_from_fs_path(&plugin_dir.join("Packages"))?,
             "Version.txt" => snapshot_from_fs_path(&plugin_dir.join("Version.txt"))?,
+            "UploadDetails.json" => snapshot_from_fs_path(&plugin_dir.join("UploadDetails.json"))?,
         }),
     });
 

crates/memofs/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased Changes
 * Added `Vfs::canonicalize`. [#1201]
+* **Breaking:** `StdBackend::new` and `Vfs::new_default` now return `io::Result`, so a failure to create the filesystem watcher is reported as an error instead of panicking. The `Default` implementation for `StdBackend` has been removed as a result. [#1267]
+
+[#1267]: https://github.com/rojo-rbx/rojo/pull/1267
 
 ## 0.3.1 (2025-11-27)
 * Added `Vfs::exists`. [#1169]

crates/memofs/src/lib.rs

@@ -255,8 +255,11 @@ pub struct Vfs {
 
 impl Vfs {
     /// Creates a new `Vfs` with the default backend, `StdBackend`.
-    pub fn new_default() -> Self {
-        Self::new(StdBackend::new())
+    ///
+    /// Returns an error if the filesystem watcher could not be initialized,
+    /// which can happen in restricted or sandboxed environments.
+    pub fn new_default() -> io::Result<Self> {
+        Ok(Self::new(StdBackend::new()?))
     }
 
     /// Creates a new `Vfs` with the given backend.
@@ -639,7 +642,7 @@ mod test {
         let file_path = dir.path().join("file.txt");
         fs_err::write(&file_path, contents.to_string()).unwrap();
 
-        let vfs = Vfs::new(StdBackend::new());
+        let vfs = Vfs::new(StdBackend::new().unwrap());
         let canonicalized = vfs.canonicalize(&file_path).unwrap();
         assert_eq!(canonicalized, file_path.canonicalize().unwrap());
         assert_eq!(
@@ -653,7 +656,7 @@ mod test {
         let dir = tempfile::tempdir().unwrap();
         let file_path = dir.path().join("test");
 
-        let vfs = Vfs::new(StdBackend::new());
+        let vfs = Vfs::new(StdBackend::new().unwrap());
         let err = vfs.canonicalize(&file_path).unwrap_err();
         assert_eq!(err.kind(), io::ErrorKind::NotFound);
     }

crates/memofs/src/std_backend.rs

@@ -17,9 +17,9 @@ pub struct StdBackend {
 }
 
 impl StdBackend {
-    pub fn new() -> StdBackend {
+    pub fn new() -> io::Result<StdBackend> {
         let (notify_tx, notify_rx) = mpsc::channel();
-        let watcher = watcher(notify_tx, Duration::from_millis(50)).unwrap();
+        let watcher = watcher(notify_tx, Duration::from_millis(50)).map_err(io::Error::other)?;
 
         let (tx, rx) = crossbeam_channel::unbounded();
 
@@ -46,11 +46,11 @@ impl StdBackend {
             Result::<(), crossbeam_channel::SendError<VfsEvent>>::Ok(())
         });
 
-        Self {
+        Ok(Self {
             watcher,
             watcher_receiver: rx,
             watches: HashSet::new(),
-        }
+        })
     }
 }
 
@@ -134,9 +134,3 @@ impl VfsBackend for StdBackend {
         self.watcher.unwatch(path).map_err(io::Error::other)
     }
 }
-
-impl Default for StdBackend {
-    fn default() -> Self {
-        Self::new()
-    }
-}

plugin.project.json

@@ -22,6 +22,9 @@
     },
     "Version": {
       "$path": "plugin/Version.txt"
+    },
+    "UploadDetails": {
+      "$path": "plugin/UploadDetails.json"
     }
   }
 }

plugin/UploadDetails.json

@@ -0,0 +1,7 @@
+{
+  "assetId": 13916111004,
+  "name": "Rojo",
+  "description": "The plugin portion of Rojo, a tool to enable professional tooling for Roblox developers.",
+  "creatorId": 32644114,
+  "creatorType": "Group"
+}

plugin/http/Response.lua

@@ -1,5 +1,7 @@
 local HttpService = game:GetService("HttpService")
 
+local msgpack = require(script.Parent.Parent.msgpack)
+
 local stringTemplate = [[
 Http.Response {
 	code: %d
@@ -31,4 +33,8 @@ function Response:json()
 	return HttpService:JSONDecode(self.body)
 end
 
+function Response:msgpack()
+	return msgpack.decode(self.body)
+end
+
 return Response

plugin/http/init.lua

@@ -1,7 +1,8 @@
 local HttpService = game:GetService("HttpService")
 
-local Promise = require(script.Parent.Promise)
 local Log = require(script.Parent.Log)
+local msgpack = require(script.Parent.msgpack)
+local Promise = require(script.Parent.Promise)
 
 local HttpError = require(script.Error)
 local HttpResponse = require(script.Response)
@@ -13,6 +14,13 @@ local Http = {}
 Http.Error = HttpError
 Http.Response = HttpResponse
 
+-- Monkey patch msgpack.UInt64.new to lossily convert the low and high bits of the integer
+-- to a native Luau number. We should change the upstream decoder to emit a native
+-- integer, once those are live.
+function msgpack.UInt64.new(mostSignificantPart: number, leastSignificantPart: number): number
+	return (mostSignificantPart % 2 ^ 32) * 2 ^ 32 + (leastSignificantPart % 2 ^ 32)
+end
+
 local function performRequest(requestParams)
 	local requestId = lastRequestId + 1
 	lastRequestId = requestId
@@ -68,4 +76,12 @@ function Http.jsonDecode(source)
 	return HttpService:JSONDecode(source)
 end
 
+function Http.msgpackEncode(object)
+	return msgpack.encode(object)
+end
+
+function Http.msgpackDecode(source)
+	return msgpack.decode(source)
+end
+
 return Http

plugin/run-tests.server.lua

@@ -1,8 +1,8 @@
 local ReplicatedStorage = game:GetService("ReplicatedStorage")
 
-local TestEZ = require(ReplicatedStorage.Packages:WaitForChild("TestEZ", 10))
+local TestEZ = require(ReplicatedStorage:WaitForChild("Packages", 10):WaitForChild("TestEZ", 10))
 
-local Rojo = ReplicatedStorage.Rojo
+local Rojo = ReplicatedStorage:WaitForChild("Rojo", 10)
 
 local Settings = require(Rojo.Plugin.Settings)
 Settings:set("logLevel", "Trace")

plugin/src/ApiContext.lua

@@ -145,7 +145,7 @@ function ApiContext:connect()
 
 	return Http.get(url)
 		:andThen(rejectFailedRequests)
-		:andThen(Http.Response.json)
+		:andThen(Http.Response.msgpack)
 		:andThen(rejectWrongProtocolVersion)
 		:andThen(function(body)
 			assert(validateApiInfo(body))
@@ -163,7 +163,7 @@ end
 function ApiContext:read(ids)
 	local url = ("%s/api/read/%s"):format(self.__baseUrl, table.concat(ids, ","))
 
-	return Http.get(url):andThen(rejectFailedRequests):andThen(Http.Response.json):andThen(function(body)
+	return Http.get(url):andThen(rejectFailedRequests):andThen(Http.Response.msgpack):andThen(function(body)
 		if body.sessionId ~= self.__sessionId then
 			return Promise.reject("Server changed ID")
 		end
@@ -191,9 +191,9 @@ function ApiContext:write(patch)
 		table.insert(updated, fixedUpdate)
 	end
 
-	-- Only add the 'added' field if the table is non-empty, or else Roblox's
-	-- JSON implementation will turn the table into an array instead of an
-	-- object, causing API validation to fail.
+	-- Only add the 'added' field if the table is non-empty, or else the msgpack
+	-- encode implementation will turn the table into an array instead of a map,
+	-- causing API validation to fail.
 	local added
 	if next(patch.added) ~= nil then
 		added = patch.added
@@ -206,13 +206,16 @@ function ApiContext:write(patch)
 		added = added,
 	}
 
-	body = Http.jsonEncode(body)
+	body = Http.msgpackEncode(body)
 
-	return Http.post(url, body):andThen(rejectFailedRequests):andThen(Http.Response.json):andThen(function(responseBody)
-		Log.info("Write response: {:?}", responseBody)
+	return Http.post(url, body)
+		:andThen(rejectFailedRequests)
+		:andThen(Http.Response.msgpack)
+		:andThen(function(responseBody)
+			Log.info("Write response: {:?}", responseBody)
 
-		return responseBody
-	end)
+			return responseBody
+		end)
 end
 
 function ApiContext:connectWebSocket(packetHandlers)
@@ -234,7 +237,7 @@ function ApiContext:connectWebSocket(packetHandlers)
 		local closed, errored, received
 
 		received = self.__wsClient.MessageReceived:Connect(function(msg)
-			local data = Http.jsonDecode(msg)
+			local data = Http.msgpackDecode(msg)
 			if data.sessionId ~= self.__sessionId then
 				Log.warn("Received message with wrong session ID; ignoring")
 				return
@@ -280,7 +283,7 @@ end
 function ApiContext:open(id)
 	local url = ("%s/api/open/%s"):format(self.__baseUrl, id)
 
-	return Http.post(url, ""):andThen(rejectFailedRequests):andThen(Http.Response.json):andThen(function(body)
+	return Http.post(url, ""):andThen(rejectFailedRequests):andThen(Http.Response.msgpack):andThen(function(body)
 		if body.sessionId ~= self.__sessionId then
 			return Promise.reject("Server changed ID")
 		end
@@ -291,11 +294,11 @@ end
 
 function ApiContext:serialize(ids: { string })
 	local url = ("%s/api/serialize"):format(self.__baseUrl)
-	local request_body = Http.jsonEncode({ sessionId = self.__sessionId, ids = ids })
+	local request_body = Http.msgpackEncode({ sessionId = self.__sessionId, ids = ids })
 
 	return Http.post(url, request_body)
 		:andThen(rejectFailedRequests)
-		:andThen(Http.Response.json)
+		:andThen(Http.Response.msgpack)
 		:andThen(function(response_body)
 			if response_body.sessionId ~= self.__sessionId then
 				return Promise.reject("Server changed ID")
@@ -309,11 +312,11 @@ end
 
 function ApiContext:refPatch(ids: { string })
 	local url = ("%s/api/ref-patch"):format(self.__baseUrl)
-	local request_body = Http.jsonEncode({ sessionId = self.__sessionId, ids = ids })
+	local request_body = Http.msgpackEncode({ sessionId = self.__sessionId, ids = ids })
 
 	return Http.post(url, request_body)
 		:andThen(rejectFailedRequests)
-		:andThen(Http.Response.json)
+		:andThen(Http.Response.msgpack)
 		:andThen(function(response_body)
 			if response_body.sessionId ~= self.__sessionId then
 				return Promise.reject("Server changed ID")

plugin/src/App/Components/Notifications/FullscreenNotification.lua

@@ -19,9 +19,15 @@ local FullscreenNotification = Roact.Component:extend("FullscreeFullscreenNotifi
 function FullscreenNotification:init()
 	self.transparency, self.setTransparency = Roact.createBinding(0)
 	self.lifetime = self.props.timeout
+	self.dismissed = false
 end
 
 function FullscreenNotification:dismiss()
+	if self.dismissed then
+		return
+	end
+	self.dismissed = true
+
 	if self.props.onClose then
 		self.props.onClose()
 	end
@@ -59,7 +65,7 @@ function FullscreenNotification:didMount()
 end
 
 function FullscreenNotification:willUnmount()
-	if self.timeout and coroutine.status(self.timeout) ~= "dead" then
+	if self.timeout and coroutine.status(self.timeout) == "suspended" then
 		task.cancel(self.timeout)
 	end
 end

plugin/src/App/Components/Notifications/Notification.lua

@@ -25,6 +25,7 @@ function Notification:init()
 	self.binding = bindingUtil.fromMotor(self.motor)
 
 	self.lifetime = self.props.timeout
+	self.dismissed = false
 
 	self.motor:onStep(function(value)
 		if value <= 0 and self.props.onClose then
@@ -34,6 +35,11 @@ function Notification:init()
 end
 
 function Notification:dismiss()
+	if self.dismissed then
+		return
+	end
+	self.dismissed = true
+
 	self.motor:setGoal(Flipper.Spring.new(0, {
 		frequency = 5,
 		dampingRatio = 1,
@@ -75,7 +81,7 @@ function Notification:didMount()
 end
 
 function Notification:willUnmount()
-	if self.timeout and coroutine.status(self.timeout) ~= "dead" then
+	if self.timeout and coroutine.status(self.timeout) == "suspended" then
 		task.cancel(self.timeout)
 	end
 end

plugin/src/App/init.lua

@@ -301,6 +301,19 @@ function App:setPriorSyncInfo(host: string, port: string, projectName: string)
 	Settings:set("priorEndpoints", priorSyncInfos)
 end
 
+function App:forgetPriorSyncInfo()
+	local priorSyncInfos = Settings:get("priorEndpoints")
+	if not priorSyncInfos then
+		priorSyncInfos = {}
+	end
+
+	local id = tostring(game.PlaceId)
+	priorSyncInfos[id] = nil
+	Log.trace("Erased last used endpoint for {}", game.PlaceId)
+
+	Settings:set("priorEndpoints", priorSyncInfos)
+end
+
 function App:getHostAndPort()
 	local host = self.host:getValue()
 	local port = self.port:getValue()
@@ -435,7 +448,8 @@ function App:checkSyncReminder()
 	self:findActiveServer()
 		:andThen(function(serverInfo, host, port)
 			self:sendSyncReminder(
-				`Project '{serverInfo.projectName}' is serving at {host}:{port}.\nWould you like to connect?`
+				`Project '{serverInfo.projectName}' is serving at {host}:{port}.\nWould you like to connect?`,
+				{ "Connect", "Dismiss" }
 			)
 		end)
 		:catch(function()
@@ -446,7 +460,8 @@ function App:checkSyncReminder()
 
 				local timeSinceSync = timeUtil.elapsedToText(os.time() - priorSyncInfo.timestamp)
 				self:sendSyncReminder(
-					`You synced project '{priorSyncInfo.projectName}' to this place {timeSinceSync}.\nDid you mean to run 'rojo serve' and then connect?`
+					`You synced project '{priorSyncInfo.projectName}' to this place {timeSinceSync}.\nDid you mean to run 'rojo serve' and then connect?`,
+					{ "Connect", "Forget", "Dismiss" }
 				)
 			end
 		end)
@@ -486,12 +501,16 @@ function App:stopSyncReminderPolling()
 	end
 end
 
-function App:sendSyncReminder(message: string)
+function App:sendSyncReminder(message: string, shownActions: { string })
 	local syncReminderMode = Settings:get("syncReminderMode")
 	if syncReminderMode == "None" then
 		return
 	end
 
+	local connectIndex = table.find(shownActions, "Connect")
+	local forgetIndex = table.find(shownActions, "Forget")
+	local dismissIndex = table.find(shownActions, "Dismiss")
+
 	self.dismissSyncReminder = self:addNotification({
 		text = message,
 		timeout = 120,
@@ -500,24 +519,39 @@ function App:sendSyncReminder(message: string)
 			self.dismissSyncReminder = nil
 		end,
 		actions = {
-			Connect = {
-				text = "Connect",
-				style = "Solid",
-				layoutOrder = 1,
-				onClick = function()
-					self:startSession()
-				end,
-			},
-			Dismiss = {
-				text = "Dismiss",
-				style = "Bordered",
-				layoutOrder = 2,
-				onClick = function()
-					-- If the user dismisses the reminder,
-					-- then we don't need to remind them again
-					self:stopSyncReminderPolling()
-				end,
-			},
+			Connect = if connectIndex
+				then {
+					text = "Connect",
+					style = "Solid",
+					layoutOrder = connectIndex,
+					onClick = function()
+						self:startSession()
+					end,
+				}
+				else nil,
+			Forget = if forgetIndex
+				then {
+					text = "Forget",
+					style = "Bordered",
+					layoutOrder = forgetIndex,
+					onClick = function()
+						-- The user doesn't want to be reminded again about this sync
+						self:forgetPriorSyncInfo()
+					end,
+				}
+				else nil,
+			Dismiss = if dismissIndex
+				then {
+					text = "Dismiss",
+					style = "Bordered",
+					layoutOrder = dismissIndex,
+					onClick = function()
+						-- If the user dismisses the reminder,
+						-- then we don't need to remind them again
+						self:stopSyncReminderPolling()
+					end,
+				}
+				else nil,
 		},
 	})
 end

plugin/src/Reconciler/countMatchingProperties.lua

@@ -0,0 +1,44 @@
+--[[
+	Counts how many of a virtual instance's properties match the live values on a
+	candidate Roblox instance. `hydrate` uses this to break ties when several
+	existing children share the same Name and ClassName.
+
+	This mirrors the read -> decode -> compare flow that `diff` uses, reusing the
+	same `getProperty`, `decodeValue`, and `trueEquals` helpers.
+]]
+
+local getProperty = require(script.Parent.getProperty)
+local decodeValue = require(script.Parent.decodeValue)
+local trueEquals = require(script.Parent.trueEquals)
+
+local function countMatchingProperties(instance, virtualInstance, instanceMap)
+	local score = 0
+
+	for propertyName, virtualValue in virtualInstance.Properties do
+		-- Skip refs. During hydration the instanceMap is still being built
+		-- top-down, so a ref may point at an instance we haven't hydrated yet
+		-- and therefore can't decode reliably. Refs are also a poor
+		-- disambiguator between same-named siblings.
+		if next(virtualValue) == "Ref" then
+			continue
+		end
+
+		local getSuccess, existingValue = getProperty(instance, propertyName)
+		if not getSuccess then
+			continue
+		end
+
+		local decodeSuccess, decodedValue = decodeValue(virtualValue, instanceMap)
+		if not decodeSuccess then
+			continue
+		end
+
+		if trueEquals(existingValue, decodedValue) then
+			score += 1
+		end
+	end
+
+	return score
+end
+
+return countMatchingProperties

plugin/src/Reconciler/countMatchingProperties.spec.lua

@@ -0,0 +1,91 @@
+return function()
+	local countMatchingProperties = require(script.Parent.countMatchingProperties)
+
+	local InstanceMap = require(script.Parent.Parent.InstanceMap)
+
+	it("counts properties whose values match the instance", function()
+		local instance = Instance.new("StringValue")
+		instance.Value = "hello"
+
+		local virtualInstance = {
+			ClassName = "StringValue",
+			Name = "Value",
+			Properties = {
+				Value = { String = "hello" },
+			},
+			Children = {},
+		}
+
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(1)
+	end)
+
+	it("does not count properties whose values differ", function()
+		local instance = Instance.new("StringValue")
+		instance.Value = "hello"
+
+		local virtualInstance = {
+			ClassName = "StringValue",
+			Name = "Value",
+			Properties = {
+				Value = { String = "different" },
+			},
+			Children = {},
+		}
+
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(0)
+	end)
+
+	it("counts multiple matching properties independently", function()
+		local instance = Instance.new("Part")
+		instance.Anchored = true
+		instance.CanCollide = false
+
+		local virtualInstance = {
+			ClassName = "Part",
+			Name = "Part",
+			Properties = {
+				Anchored = { Bool = true },
+				CanCollide = { Bool = false },
+			},
+			Children = {},
+		}
+
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(2)
+
+		-- Flip one so only a single property matches.
+		instance.CanCollide = true
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(1)
+	end)
+
+	it("skips unknown properties without counting or erroring", function()
+		local instance = Instance.new("Folder")
+
+		local virtualInstance = {
+			ClassName = "Folder",
+			Name = "Folder",
+			Properties = {
+				FAKE_PROPERTY = { String = "nope" },
+			},
+			Children = {},
+		}
+
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(0)
+	end)
+
+	it("skips Ref properties without counting or erroring", function()
+		local instance = Instance.new("ObjectValue")
+
+		local virtualInstance = {
+			ClassName = "ObjectValue",
+			Name = "ObjectValue",
+			Properties = {
+				-- A ref must be skipped rather than decoded: during hydration
+				-- the target may not be in the map yet.
+				Value = { Ref = "00000000000000000000000000000000" },
+			},
+			Children = {},
+		}
+
+		expect(countMatchingProperties(instance, virtualInstance, InstanceMap.new())).to.equal(0)
+	end)
+end

plugin/src/Reconciler/diff.lua

@@ -10,100 +10,12 @@ local invariant = require(script.Parent.Parent.invariant)
 local getProperty = require(script.Parent.getProperty)
 local Error = require(script.Parent.Error)
 local decodeValue = require(script.Parent.decodeValue)
+local trueEquals = require(script.Parent.trueEquals)
 
 local function isEmpty(table)
 	return next(table) == nil
 end
 
-local function fuzzyEq(a: number, b: number, epsilon: number): boolean
-	return math.abs(a - b) < epsilon
-end
-
-local function trueEquals(a, b): boolean
-	-- Exit early for simple equality values
-	if a == b then
-		return true
-	end
-
-	-- Treat nil and { Ref = "000...0" } as equal
-	if
-		(a == nil and type(b) == "table" and b.Ref == "00000000000000000000000000000000")
-		or (b == nil and type(a) == "table" and a.Ref == "00000000000000000000000000000000")
-	then
-		return true
-	end
-
-	local typeA, typeB = typeof(a), typeof(b)
-
-	-- For tables, try recursive deep equality
-	if typeA == "table" and typeB == "table" then
-		local checkedKeys = {}
-		for key, value in a do
-			checkedKeys[key] = true
-			if not trueEquals(value, b[key]) then
-				return false
-			end
-		end
-		for key, value in b do
-			if checkedKeys[key] then
-				continue
-			end
-			if not trueEquals(value, a[key]) then
-				return false
-			end
-		end
-		return true
-
-	-- For numbers, compare with epsilon of 0.0001 to avoid floating point inequality
-	elseif typeA == "number" and typeB == "number" then
-		return fuzzyEq(a, b, 0.0001)
-
-	-- For EnumItem->number, compare the EnumItem's value
-	elseif typeA == "number" and typeB == "EnumItem" then
-		return a == b.Value
-	elseif typeA == "EnumItem" and typeB == "number" then
-		return a.Value == b
-
-	-- For Color3s, compare to RGB ints to avoid floating point inequality
-	elseif typeA == "Color3" and typeB == "Color3" then
-		local aR, aG, aB = math.floor(a.R * 255), math.floor(a.G * 255), math.floor(a.B * 255)
-		local bR, bG, bB = math.floor(b.R * 255), math.floor(b.G * 255), math.floor(b.B * 255)
-		return aR == bR and aG == bG and aB == bB
-
-	-- For CFrames, compare to components with epsilon of 0.0001 to avoid floating point inequality
-	elseif typeA == "CFrame" and typeB == "CFrame" then
-		local aComponents, bComponents = { a:GetComponents() }, { b:GetComponents() }
-		for i, aComponent in aComponents do
-			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
-				return false
-			end
-		end
-		return true
-
-	-- For Vector3s, compare to components with epsilon of 0.0001 to avoid floating point inequality
-	elseif typeA == "Vector3" and typeB == "Vector3" then
-		local aComponents, bComponents = { a.X, a.Y, a.Z }, { b.X, b.Y, b.Z }
-		for i, aComponent in aComponents do
-			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
-				return false
-			end
-		end
-		return true
-
-	-- For Vector2s, compare to components with epsilon of 0.0001 to avoid floating point inequality
-	elseif typeA == "Vector2" and typeB == "Vector2" then
-		local aComponents, bComponents = { a.X, a.Y }, { b.X, b.Y }
-		for i, aComponent in aComponents do
-			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
-				return false
-			end
-		end
-		return true
-	end
-
-	return false
-end
-
 local function shouldDeleteUnknownInstances(virtualInstance)
 	if virtualInstance.Metadata ~= nil then
 		return not virtualInstance.Metadata.ignoreUnknownInstances

plugin/src/Reconciler/hydrate.lua

@@ -3,9 +3,22 @@
 	concrete instances and assigning them IDs.
 ]]
 
-local invariant = require(script.Parent.Parent.invariant)
+local Packages = script.Parent.Parent.Parent.Packages
+local Log = require(Packages.Log)
 
-local function hydrate(instanceMap, virtualInstances, rootId, rootInstance)
+local invariant = require(script.Parent.Parent.invariant)
+local countMatchingProperties = require(script.Parent.countMatchingProperties)
+
+-- When several existing children share a Name and ClassName we disambiguate
+-- them by scoring how well each one's properties match the virtual instance.
+-- That scoring is far more expensive than a Name/ClassName check, so we only do
+-- it for reasonably-sized groups. Larger groups (e.g. a folder with thousands of
+-- identically-named parts) fall back to the original order-based matching, which
+-- bounds the added work to roughly MAX_CANDIDATES_TO_SCORE^2 property reads per
+-- group regardless of how large the group is.
+local MAX_CANDIDATES_TO_SCORE = 32
+
+local function hydrateInner(stats, instanceMap, virtualInstances, rootId, rootInstance)
 	local virtualInstance = virtualInstances[rootId]
 
 	if virtualInstance == nil then
@@ -13,38 +26,163 @@ local function hydrate(instanceMap, virtualInstances, rootId, rootInstance)
 	end
 
 	instanceMap:insert(rootId, rootInstance)
+	stats.hydrated += 1
 
 	local existingChildren = rootInstance:GetChildren()
 
-	-- For each existing child, we'll track whether it's been paired with an
-	-- instance that the Rojo server knows about.
-	local isExistingChildVisited = {}
-	for i = 1, #existingChildren do
-		isExistingChildVisited[i] = false
+	-- Group existing children by Name then ClassName so each virtual child can
+	-- find its candidate matches without scanning every sibling. This is what
+	-- keeps hydration fast for parents with thousands of children. Nesting the
+	-- two tables (rather than a combined key) keeps the Name and ClassName checks
+	-- exact, with no way for one to bleed into the other.
+	local buckets = {}
+	for _, childInstance in existingChildren do
+		-- We guard accessing Name and ClassName in order to avoid tripping over
+		-- children of DataModel that Rojo won't have permissions to access at all.
+		local accessSuccess, name, className = pcall(function()
+			return childInstance.Name, childInstance.ClassName
+		end)
+		if not accessSuccess then
+			continue
+		end
+
+		local bucketsByClassName = buckets[name]
+		if bucketsByClassName == nil then
+			bucketsByClassName = {}
+			buckets[name] = bucketsByClassName
+		end
+
+		local bucket = bucketsByClassName[className]
+		if bucket == nil then
+			bucket = { cursor = 1, instances = {} }
+			bucketsByClassName[className] = bucket
+		end
+
+		table.insert(bucket.instances, childInstance)
 	end
 
+	-- Tracks which existing children have already been paired, so one instance
+	-- isn't matched to two different virtual instances.
+	local visited = {}
+
 	for _, childId in ipairs(virtualInstance.Children) do
 		local virtualChild = virtualInstances[childId]
 
-		for childIndex, childInstance in existingChildren do
-			if not isExistingChildVisited[childIndex] then
-				-- We guard accessing Name and ClassName in order to avoid
-				-- tripping over children of DataModel that Rojo won't have
-				-- permissions to access at all.
-				local accessSuccess, name, className = pcall(function()
-					return childInstance.Name, childInstance.ClassName
-				end)
+		local bucketsByClassName = buckets[virtualChild.Name]
+		local bucket = bucketsByClassName and bucketsByClassName[virtualChild.ClassName]
+		if bucket == nil then
+			-- No existing instance matches; diff will mark this id for creation.
+			Log.trace(
+				"hydrate: no existing instance matches {} ({}) for id {}",
+				virtualChild.Name,
+				virtualChild.ClassName,
+				childId
+			)
+			continue
+		end
 
-				-- This rule is very conservative and could be loosened in the
-				-- future, or more heuristics could be introduced.
-				if accessSuccess and name == virtualChild.Name and className == virtualChild.ClassName then
-					isExistingChildVisited[childIndex] = true
-					hydrate(instanceMap, virtualInstances, childId, childInstance)
-					break
+		local instances = bucket.instances
+
+		-- Advance past any leading children that have already been paired. The
+		-- cursor makes order-based matching amortized O(1) per child even for
+		-- very large groups, rather than rescanning the visited prefix.
+		while bucket.cursor <= #instances and visited[instances[bucket.cursor]] do
+			bucket.cursor += 1
+		end
+		if bucket.cursor > #instances then
+			-- Every matching instance has already been paired with an earlier id.
+			Log.trace(
+				"hydrate: no unpaired instance left for {} ({}) for id {}",
+				virtualChild.Name,
+				virtualChild.ClassName,
+				childId
+			)
+			continue
+		end
+
+		-- The cursor points at the earliest unvisited child, so the slots from
+		-- here to the end bound how many candidates remain. Visited children
+		-- after the cursor (gaps) only appear once a group is small enough to be
+		-- scored -- the order-based path below always takes the earliest, which
+		-- keeps the visited region a contiguous prefix. So whenever this count
+		-- exceeds the cap it is exact, and we can pick the earliest match without
+		-- collecting anything.
+		local remaining = #instances - bucket.cursor + 1
+
+		local match
+		if remaining > MAX_CANDIDATES_TO_SCORE then
+			-- Too many to score affordably; take the earliest in child order,
+			-- reproducing the original Name + ClassName behavior.
+			match = instances[bucket.cursor]
+			Log.trace(
+				"hydrate: {} candidates named {} ({}) exceeds the scoring cap of {}; matching id {} by child order",
+				remaining,
+				virtualChild.Name,
+				virtualChild.ClassName,
+				MAX_CANDIDATES_TO_SCORE,
+				childId
+			)
+		else
+			-- Collect the (at most `remaining`) unvisited candidates.
+			local candidates = {}
+			for index = bucket.cursor, #instances do
+				local childInstance = instances[index]
+				if not visited[childInstance] then
+					table.insert(candidates, childInstance)
 				end
 			end
+
+			if #candidates == 1 then
+				-- Only one candidate, so there's nothing to disambiguate.
+				match = candidates[1]
+			else
+				-- Break the tie by choosing the candidate whose properties best
+				-- match the virtual instance, falling back to the earliest in
+				-- child order when scores are equal.
+				local bestScore = -1
+				for _, childInstance in candidates do
+					local score = countMatchingProperties(childInstance, virtualChild, instanceMap)
+					if score > bestScore then
+						bestScore = score
+						match = childInstance
+					end
+				end
+
+				stats.ambiguousGroups += 1
+				stats.candidatesScored += #candidates
+				Log.trace(
+					"hydrate: disambiguated {} candidates named {} ({}) for id {} by property match (best score {})",
+					#candidates,
+					virtualChild.Name,
+					virtualChild.ClassName,
+					childId,
+					bestScore
+				)
+			end
 		end
+
+		visited[match] = true
+		hydrateInner(stats, instanceMap, virtualInstances, childId, match)
 	end
 end
 
+local function hydrate(instanceMap, virtualInstances, rootId, rootInstance)
+	-- Tallies of the work hydration did, surfaced in a single debug log below so
+	-- the cost of property-based disambiguation is visible without per-node spam.
+	local stats = {
+		hydrated = 0,
+		ambiguousGroups = 0,
+		candidatesScored = 0,
+	}
+
+	hydrateInner(stats, instanceMap, virtualInstances, rootId, rootInstance)
+
+	Log.debug(
+		"Hydrated {} instances ({} ambiguous name+class groups, {} candidates scored)",
+		stats.hydrated,
+		stats.ambiguousGroups,
+		stats.candidatesScored
+	)
+end
+
 return hydrate

plugin/src/Reconciler/hydrate.spec.lua

@@ -126,4 +126,140 @@ return function()
 		expect(knownInstances.fromIds["CHILD1"]).to.equal(child1)
 		expect(knownInstances.fromIds["CHILD2"]).to.equal(child2)
 	end)
+
+	it("should disambiguate duplicate-named siblings by matching properties", function()
+		local knownInstances = InstanceMap.new()
+		local virtualInstances = {
+			ROOT = {
+				ClassName = "Folder",
+				Name = "Root",
+				Properties = {},
+				Children = { "CHILD_A", "CHILD_B" },
+			},
+
+			CHILD_A = {
+				ClassName = "StringValue",
+				Name = "a",
+				Properties = { Value = { String = "first" } },
+				Children = {},
+			},
+
+			CHILD_B = {
+				ClassName = "StringValue",
+				Name = "a",
+				Properties = { Value = { String = "second" } },
+				Children = {},
+			},
+		}
+
+		local rootInstance = Instance.new("Folder")
+
+		-- Created in the reverse order of the virtual children, so a purely
+		-- order-based tiebreak would mis-pair them.
+		local child1 = Instance.new("StringValue")
+		child1.Name = "a"
+		child1.Value = "second"
+		child1.Parent = rootInstance
+
+		local child2 = Instance.new("StringValue")
+		child2.Name = "a"
+		child2.Value = "first"
+		child2.Parent = rootInstance
+
+		hydrate(knownInstances, virtualInstances, "ROOT", rootInstance)
+
+		expect(knownInstances:size()).to.equal(3)
+		expect(knownInstances.fromIds["CHILD_A"]).to.equal(child2)
+		expect(knownInstances.fromIds["CHILD_B"]).to.equal(child1)
+	end)
+
+	it("should fall back to child order for duplicate-named siblings with no distinguishing properties", function()
+		local knownInstances = InstanceMap.new()
+		local virtualInstances = {
+			ROOT = {
+				ClassName = "Folder",
+				Name = "Root",
+				Properties = {},
+				Children = { "CHILD_A", "CHILD_B" },
+			},
+
+			CHILD_A = {
+				ClassName = "Folder",
+				Name = "a",
+				Properties = {},
+				Children = {},
+			},
+
+			CHILD_B = {
+				ClassName = "Folder",
+				Name = "a",
+				Properties = {},
+				Children = {},
+			},
+		}
+
+		local rootInstance = Instance.new("Folder")
+
+		local child1 = Instance.new("Folder")
+		child1.Name = "a"
+		child1.Parent = rootInstance
+
+		local child2 = Instance.new("Folder")
+		child2.Name = "a"
+		child2.Parent = rootInstance
+
+		hydrate(knownInstances, virtualInstances, "ROOT", rootInstance)
+
+		expect(knownInstances:size()).to.equal(3)
+		-- With equal scores the earliest unvisited child wins, preserving the
+		-- original order-based behavior.
+		expect(knownInstances.fromIds["CHILD_A"]).to.equal(child1)
+		expect(knownInstances.fromIds["CHILD_B"]).to.equal(child2)
+	end)
+
+	it("should fall back to child order for very large duplicate-named groups", function()
+		-- More candidates than hydrate is willing to score at once. The group
+		-- must fall back to order-based matching, so virtual child N pairs with
+		-- existing child N regardless of properties.
+		local count = 64
+
+		local knownInstances = InstanceMap.new()
+		local virtualInstances = {
+			ROOT = {
+				ClassName = "Folder",
+				Name = "Root",
+				Properties = {},
+				Children = {},
+			},
+		}
+
+		local rootInstance = Instance.new("Folder")
+
+		local expectedInstances = {}
+		for i = 1, count do
+			local id = "CHILD_" .. i
+			table.insert(virtualInstances.ROOT.Children, id)
+			virtualInstances[id] = {
+				ClassName = "StringValue",
+				Name = "a",
+				-- Distinct values that, if scored, would pair by value rather
+				-- than by order.
+				Properties = { Value = { String = "value " .. i } },
+				Children = {},
+			}
+
+			local child = Instance.new("StringValue")
+			child.Name = "a"
+			child.Value = "value " .. (count - i + 1)
+			child.Parent = rootInstance
+			expectedInstances[id] = child
+		end
+
+		hydrate(knownInstances, virtualInstances, "ROOT", rootInstance)
+
+		expect(knownInstances:size()).to.equal(count + 1)
+		for id, expectedInstance in expectedInstances do
+			expect(knownInstances.fromIds[id]).to.equal(expectedInstance)
+		end
+	end)
 end

plugin/src/Reconciler/trueEquals.lua

@@ -0,0 +1,100 @@
+--[[
+	Fuzzy value-equality used to compare a decoded virtual property value against
+	the live value read from a real instance. Shared by `diff` (to decide whether
+	a property changed) and `hydrate` (to score candidate instances).
+]]
+
+local function fuzzyEq(a: number, b: number, epsilon: number): boolean
+	return math.abs(a - b) < epsilon
+end
+
+local function trueEquals(a, b): boolean
+	-- Exit early for simple equality values
+	if a == b then
+		return true
+	end
+
+	-- Treat nil and { Ref = "000...0" } as equal
+	if
+		(a == nil and type(b) == "table" and b.Ref == "00000000000000000000000000000000")
+		or (b == nil and type(a) == "table" and a.Ref == "00000000000000000000000000000000")
+	then
+		return true
+	end
+
+	local typeA, typeB = typeof(a), typeof(b)
+
+	-- For tables, try recursive deep equality
+	if typeA == "table" and typeB == "table" then
+		local checkedKeys = {}
+		for key, value in a do
+			checkedKeys[key] = true
+			if not trueEquals(value, b[key]) then
+				return false
+			end
+		end
+		for key, value in b do
+			if checkedKeys[key] then
+				continue
+			end
+			if not trueEquals(value, a[key]) then
+				return false
+			end
+		end
+		return true
+
+	-- For NaN, check if both values are not equal to themselves
+	elseif a ~= a and b ~= b then
+		return true
+
+	-- For numbers, compare with epsilon of 0.0001 to avoid floating point inequality
+	elseif typeA == "number" and typeB == "number" then
+		return fuzzyEq(a, b, 0.0001)
+
+	-- For EnumItem->number, compare the EnumItem's value
+	elseif typeA == "number" and typeB == "EnumItem" then
+		return a == b.Value
+	elseif typeA == "EnumItem" and typeB == "number" then
+		return a.Value == b
+
+	-- For Color3s, compare to RGB ints to avoid floating point inequality
+	elseif typeA == "Color3" and typeB == "Color3" then
+		local aR, aG, aB = math.floor(a.R * 255), math.floor(a.G * 255), math.floor(a.B * 255)
+		local bR, bG, bB = math.floor(b.R * 255), math.floor(b.G * 255), math.floor(b.B * 255)
+		return aR == bR and aG == bG and aB == bB
+
+	-- For CFrames, compare to components with epsilon of 0.0001 to avoid floating point inequality
+	elseif typeA == "CFrame" and typeB == "CFrame" then
+		local aComponents, bComponents = { a:GetComponents() }, { b:GetComponents() }
+		for i, aComponent in aComponents do
+			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
+				return false
+			end
+		end
+		return true
+
+	-- For Vector3s, compare to components with epsilon of 0.0001 to avoid floating point inequality
+	elseif typeA == "Vector3" and typeB == "Vector3" then
+		local aComponents, bComponents = { a.X, a.Y, a.Z }, { b.X, b.Y, b.Z }
+		for i, aComponent in aComponents do
+			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
+				return false
+			end
+		end
+		return true
+
+	-- For Vector2s, compare to components with epsilon of 0.0001 to avoid floating point inequality
+	elseif typeA == "Vector2" and typeB == "Vector2" then
+		local aComponents, bComponents = { a.X, a.Y }, { b.X, b.Y }
+		for i, aComponent in aComponents do
+			if not fuzzyEq(aComponent, bComponents[i], 0.0001) then
+				return false
+			end
+		end
+		return true
+	end
+
+	return false
+end
+
+return trueEquals

plugin/src/ServeSession.lua

@@ -18,6 +18,7 @@ local PatchSet = require(script.Parent.PatchSet)
 local Reconciler = require(script.Parent.Reconciler)
 local strict = require(script.Parent.strict)
 local Settings = require(script.Parent.Settings)
+local orderSwaps = require(script.Parent.orderSwaps)
 
 local Status = strict("Session.Status", {
 	NotStarted = "NotStarted",
@@ -320,6 +321,14 @@ function ServeSession:__replaceInstances(idList)
 		return false
 	end
 
+	-- Roblox appends to GetChildren() on every reparent, so the order in which
+	-- we re-parent replacements determines their final sibling order.
+	-- We process ancestors before descendants (so each replacement's
+	-- parent already exists when we re-parent it) and siblings in their original
+	-- GetChildren() order. Because the loop below moves the old instance's
+	-- children into the replacement *before* re-parenting the replacement, this
+	-- rebuilds GetChildren() exactly as it was before the swap.
+	local swaps = {}
 	for id, replacement in replacements do
 		local oldInstance = self.__instanceMap.fromIds[id]
 		if not oldInstance then
@@ -328,6 +337,16 @@ function ServeSession:__replaceInstances(idList)
 			continue
 		end
 
+		table.insert(swaps, {
+			id = id,
+			replacement = replacement,
+			oldInstance = oldInstance,
+		})
+	end
+
+	for _, swap in orderSwaps(swaps) do
+		local id, replacement, oldInstance = swap.id, swap.replacement, swap.oldInstance
+
 		self.__instanceMap:insert(id, replacement)
 		Log.trace("Swapping Instance {} out via api/models/ endpoint", id)
 		local oldParent = oldInstance.Parent

plugin/src/orderSwaps.lua

@@ -0,0 +1,44 @@
+--[[
+	Determines the order in which `ServeSession:__replaceInstances` should swap
+	instances so that sibling order is preserved.
+
+	Roblox appends to `GetChildren()` on every reparent, so the order in which we
+	re-parent replacements determines their final sibling order. To rebuild
+	`GetChildren()` exactly as it was before the swap we must:
+
+	* process ancestors before descendants, so each replacement's parent already
+	  exists when we re-parent the replacement, and
+	* process siblings in their original `GetChildren()` order.
+
+	`swaps` is an array of `{ id, replacement, oldInstance }` entries. This sorts
+	the array in place (annotating each entry with `depth`/`siblingIndex`) and
+	returns it.
+]]
+local function orderSwaps(swaps)
+	for _, swap in swaps do
+		local depth = 0
+		local ancestor = swap.oldInstance.Parent
+		while ancestor ~= nil do
+			depth += 1
+			ancestor = ancestor.Parent
+		end
+		swap.depth = depth
+
+		local siblingIndex = 0
+		if swap.oldInstance.Parent ~= nil then
+			siblingIndex = table.find(swap.oldInstance.Parent:GetChildren(), swap.oldInstance) or 0
+		end
+		swap.siblingIndex = siblingIndex
+	end
+
+	table.sort(swaps, function(a, b)
+		if a.depth ~= b.depth then
+			return a.depth < b.depth
+		end
+		return a.siblingIndex < b.siblingIndex
+	end)
+
+	return swaps
+end
+
+return orderSwaps

plugin/src/orderSwaps.spec.lua

@@ -0,0 +1,57 @@
+return function()
+	local orderSwaps = require(script.Parent.orderSwaps)
+
+	it("orders same-named siblings by their original GetChildren order", function()
+		local parent = Instance.new("Model")
+		local a1 = Instance.new("Part")
+		a1.Name = "a"
+		a1.Parent = parent
+		local a2 = Instance.new("Part")
+		a2.Name = "a"
+		a2.Parent = parent
+		local a3 = Instance.new("Part")
+		a3.Name = "a"
+		a3.Parent = parent
+
+		-- Input deliberately out of sibling order.
+		-- orderSwaps must restore the GetChildren() order.
+		local ordered = orderSwaps({
+			{ id = "3", oldInstance = a3 },
+			{ id = "1", oldInstance = a1 },
+			{ id = "2", oldInstance = a2 },
+		})
+
+		expect(ordered[1].oldInstance).to.equal(a1)
+		expect(ordered[2].oldInstance).to.equal(a2)
+		expect(ordered[3].oldInstance).to.equal(a3)
+	end)
+
+	it("orders ancestors before descendants", function()
+		local root = Instance.new("Model")
+		local child = Instance.new("Folder")
+		child.Parent = root
+		local grandchild = Instance.new("Part")
+		grandchild.Parent = child
+
+		local ordered = orderSwaps({
+			{ id = "grandchild", oldInstance = grandchild },
+			{ id = "child", oldInstance = child },
+			{ id = "root", oldInstance = root },
+		})
+
+		expect(ordered[1].oldInstance).to.equal(root)
+		expect(ordered[2].oldInstance).to.equal(child)
+		expect(ordered[3].oldInstance).to.equal(grandchild)
+	end)
+
+	it("returns a single swap unchanged", function()
+		local part = Instance.new("Part")
+
+		local ordered = orderSwaps({
+			{ id = "1", oldInstance = part },
+		})
+
+		expect(#ordered).to.equal(1)
+		expect(ordered[1].oldInstance).to.equal(part)
+	end)
+end

rojo-test/build-test-snapshots/end_to_end__tests__build__json_model_legacy_name.snap

@@ -0,0 +1,16 @@
+---
+source: tests/tests/build.rs
+expression: contents
+---
+<roblox version="4">
+  <Item class="Folder" referent="0">
+    <Properties>
+      <string name="Name">json_model_legacy_name</string>
+    </Properties>
+    <Item class="Folder" referent="1">
+      <Properties>
+        <string name="Name">Expected Name</string>
+      </Properties>
+    </Item>
+  </Item>
+</roblox>

rojo-test/build-test-snapshots/end_to_end__tests__build__model_json_name_input.snap

@@ -1,23 +0,0 @@
----
-source: tests/tests/build.rs
-assertion_line: 109
-expression: contents
----
-<roblox version="4">
-  <Item class="DataModel" referent="0">
-    <Properties>
-      <string name="Name">model_json_name_input</string>
-    </Properties>
-    <Item class="Workspace" referent="1">
-      <Properties>
-        <string name="Name">Workspace</string>
-        <bool name="NeedsPivotMigration">false</bool>
-      </Properties>
-      <Item class="StringValue" referent="2">
-        <Properties>
-          <string name="Name">/Bar</string>
-        </Properties>
-      </Item>
-    </Item>
-  </Item>
-</roblox>

rojo-test/build-test-snapshots/end_to_end__tests__build__plugin_init.snap

@@ -0,0 +1,27 @@
+---
+source: tests/tests/build.rs
+expression: contents
+---
+<roblox version="4">
+  <Item class="Folder" referent="0">
+    <Properties>
+      <string name="Name">plugin_init</string>
+    </Properties>
+    <Item class="Script" referent="1">
+      <Properties>
+        <string name="Name">lua</string>
+        <token name="RunContext">3</token>
+        <string name="Source"><![CDATA[return "From folder/lua/init.plugin.lua"
+]]></string>
+      </Properties>
+    </Item>
+    <Item class="Script" referent="2">
+      <Properties>
+        <string name="Name">luau</string>
+        <token name="RunContext">3</token>
+        <string name="Source"><![CDATA[return "From folder/luau/init.plugin.luau"
+]]></string>
+      </Properties>
+    </Item>
+  </Item>
+</roblox>

rojo-test/build-test-snapshots/end_to_end__tests__build__slugified_name_roundtrip.snap

@@ -1,20 +0,0 @@
----
-source: tests/tests/build.rs
-assertion_line: 108
-expression: contents
----
-<roblox version="4">
-  <Item class="Folder" referent="0">
-    <Properties>
-      <string name="Name">slugified_name_roundtrip</string>
-    </Properties>
-    <Item class="Script" referent="1">
-      <Properties>
-        <string name="Name">/Script</string>
-        <token name="RunContext">0</token>
-        <string name="Source"><![CDATA[print("Hello world!")
-]]></string>
-      </Properties>
-    </Item>
-  </Item>
-</roblox>

rojo-test/build-tests/json_model_legacy_name/default.project.json

@@ -0,0 +1,6 @@
+{
+  "name": "json_model_legacy_name",
+  "tree": {
+    "$path": "folder"
+  }
+}

rojo-test/build-tests/json_model_legacy_name/folder/Expected Name.model.json

@@ -0,0 +1,4 @@
+{
+  "Name": "Overridden Name",
+  "ClassName": "Folder"
+}

rojo-test/build-tests/model_json_name_input/default.project.json

@@ -1,11 +0,0 @@
-{
-  "name": "model_json_name_input",
-  "tree": {
-    "$className": "DataModel",
-    "Workspace": {
-      "$className": "Workspace",
-      "$path": "src"
-    }
-  }
-}
-

rojo-test/build-tests/model_json_name_input/src/Bar.model.json

@@ -1,5 +0,0 @@
-{
-  "name": "/Bar",
-  "className": "StringValue"
-}
-

rojo-test/build-tests/plugin_init/default.project.json

@@ -0,0 +1,6 @@
+{
+  "name": "plugin_init",
+  "tree": {
+    "$path": "folder"
+  }
+}

rojo-test/build-tests/plugin_init/folder/lua/init.plugin.lua

@@ -0,0 +1 @@
+return "From folder/lua/init.plugin.lua"

rojo-test/build-tests/plugin_init/folder/luau/init.plugin.luau

@@ -0,0 +1 @@
+return "From folder/luau/init.plugin.luau"

rojo-test/build-tests/slugified_name_roundtrip/_Script/init.meta.json

@@ -1,4 +0,0 @@
-{
-  "name": "/Script"
-}
-

rojo-test/build-tests/slugified_name_roundtrip/_Script/init.server.luau

@@ -1,2 +0,0 @@
-print("Hello world!")
-

rojo-test/build-tests/slugified_name_roundtrip/default.project.json

@@ -1,6 +0,0 @@
-{
-  "name": "slugified_name_roundtrip",
-  "tree": {
-    "$path": "src"
-  }
-}

rojo-test/build-tests/slugified_name_roundtrip/src/_Script/init.meta.json

@@ -1,3 +0,0 @@
-{
-  "name": "/Script"
-}

rojo-test/build-tests/slugified_name_roundtrip/src/_Script/init.server.luau

@@ -1 +0,0 @@
-print("Hello world!")

rojo-test/syncback-test-snapshots/end_to_end__rojo_test__syncback_util__project_default_properties_remove-stdout.snap

@@ -1,6 +1,5 @@
 ---
 source: tests/rojo_test/syncback_util.rs
-assertion_line: 101
 expression: "String::from_utf8_lossy(&output.stdout)"
 ---
-
+Writing default.project.json

rojo-test/syncback-test-snapshots/end_to_end__rojo_test__syncback_util__slugified_name-stdout.snap

@@ -1,13 +0,0 @@
----
-source: tests/rojo_test/syncback_util.rs
-assertion_line: 101
-expression: "String::from_utf8_lossy(&output.stdout)"
----
-Writing default.project.json
-Writing src/Camera.rbxm
-Writing src/Terrain.rbxm
-Writing src/_Folder/init.meta.json
-Writing src/_Script.meta.json
-Writing src/_Script.server.luau
-Writing src
-Writing src/_Folder

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__model_json_name-src__foo.model.json.snap

@@ -1,9 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/foo.model.json
----
-{
-  "name": "/Bar",
-  "className": "StringValue"
-}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__project_default_properties_remove-default.project.json.snap

@@ -0,0 +1,59 @@
+---
+source: tests/tests/syncback.rs
+expression: default.project.json
+---
+{
+  "name": "SyncbackTest",
+  "tree": {
+    "$className": "DataModel",
+    "Workspace": {
+      "$className": "Workspace",
+      "TestPart": {
+        "$className": "Part",
+        "$properties": {
+          "Anchored": true,
+          "Color": {
+            "Color3uint8": [
+              0,
+              0,
+              255
+            ]
+          }
+        }
+      },
+      "$properties": {
+        "EnableSLIMAvatars": {
+          "Enum": 0
+        },
+        "ImprovedAnimationConstraint": {
+          "Enum": 0
+        },
+        "ImprovedPhysicsReplication": {
+          "Enum": 0
+        },
+        "LayeredClothingCacheOptimizations": {
+          "Enum": 0
+        },
+        "MeshStreamingAndImprovedLods": {
+          "Enum": 0
+        },
+        "NextGenerationReplication": {
+          "Enum": 0
+        },
+        "PlayerScriptsUseInputActionSystem": {
+          "Enum": 0
+        },
+        "UseFixedSimulation": {
+          "Enum": 0
+        },
+        "UseNewLuauTypeSolver": "Disabled",
+        "ValidateEnabledProximityPrompt": {
+          "Enum": 0
+        }
+      },
+      "$attributes": {
+        "Rojo_Target_CurrentCamera": "302d573157260ee80a3baa32000003b5"
+      }
+    }
+  }
+}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Folder.model.json.snap

@@ -1,8 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Folder.model.json
----
-{
-  "className": "Folder"
-}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Folder__init.meta.json.snap

@@ -1,8 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Folder/init.meta.json
----
-{
-  "name": "/Folder"
-}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Script.meta.json.snap

@@ -1,8 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Script.meta.json
----
-{
-  "name": "/Script"
-}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Script.server.luau.snap

@@ -1,6 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Script.server.luau
----
-print("Hello world!")

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Script__init.meta.json.snap

@@ -1,8 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Script/init.meta.json
----
-{
-  "name": "/Script"
-}

rojo-test/syncback-test-snapshots/end_to_end__tests__syncback__slugified_name-src___Script__init.server.luau.snap

@@ -1,6 +0,0 @@
----
-source: tests/tests/syncback.rs
-assertion_line: 31
-expression: src/_Script/init.server.luau
----
-print("Hello world!")

rojo-test/syncback-tests/model_json_name/input-project/default.project.json

@@ -1,11 +0,0 @@
-{
-  "name": "model_json_name",
-  "tree": {
-    "$className": "DataModel",
-    "Workspace": {
-      "$className": "Workspace",
-      "$path": "src"
-    }
-  }
-}
-

rojo-test/syncback-tests/model_json_name/input-project/src/foo.model.json

@@ -1,5 +0,0 @@
-{
-  "name": "/Bar",
-  "className": "StringValue"
-}
-

rojo-test/syncback-tests/project_default_properties_remove/input-project/default.project.json

@@ -0,0 +1,21 @@
+{
+  "name": "SyncbackTest",
+  "tree": {
+    "$className": "DataModel",
+    "Workspace": {
+      "$className": "Workspace",
+      "TestPart": {
+        "$className": "Part",
+        "$properties": {
+          "Transparency": 1.0,
+          "Anchored": true,
+          "Color": [
+            1.0,
+            0.0,
+            0.0
+          ]
+        }
+      }
+    }
+  }
+}

rojo-test/syncback-tests/slugified_name/input-project/default.project.json

@@ -1,10 +0,0 @@
-{
-  "name": "slugified_name",
-  "tree": {
-    "$className": "DataModel",
-    "Workspace": {
-      "$className": "Workspace",
-      "$path": "src"
-    }
-  }
-}

rokit.toml

@@ -3,3 +3,4 @@ rojo = "rojo-rbx/rojo@7.5.1"
 selene = "Kampfkarren/selene@0.29.0"
 stylua = "JohnnyMorganz/stylua@2.1.0"
 run-in-roblox = "rojo-rbx/run-in-roblox@0.3.0"
+lune = "lune-org/lune@0.10.4"

src/change_processor.rs

@@ -200,7 +200,15 @@ impl JobThreadContext {
                 if let Some(instance) = tree.get_instance(id) {
                     if let Some(instigating_source) = &instance.metadata().instigating_source {
                         match instigating_source {
-                            InstigatingSource::Path(path) => fs::remove_file(path).unwrap(),
+                            InstigatingSource::Path(path) => {
+                                if let Err(err) = fs::remove_file(path) {
+                                    log::error!(
+                                        "Failed to remove file {}: {}",
+                                        path.display(),
+                                        err
+                                    );
+                                }
+                            }
                             InstigatingSource::ProjectNode { .. } => {
                                 log::warn!(
                                     "Cannot remove instance {:?}, it's from a project file",
@@ -244,7 +252,13 @@ impl JobThreadContext {
                                 match instigating_source {
                                     InstigatingSource::Path(path) => {
                                         if let Some(Variant::String(value)) = changed_value {
-                                            fs::write(path, value).unwrap();
+                                            if let Err(err) = fs::write(path, value) {
+                                                log::error!(
+                                                    "Failed to write file {}: {}",
+                                                    path.display(),
+                                                    err
+                                                );
+                                            }
                                         } else {
                                             log::warn!("Cannot change Source to non-string value.");
                                         }

src/cli/build.rs

@@ -75,10 +75,10 @@ impl BuildCommand {
             _ => unreachable!(),
         };
 
-        let project_path = resolve_path(&self.project);
+        let project_path = resolve_path(&self.project)?;
 
         log::trace!("Constructing in-memory filesystem");
-        let vfs = Vfs::new_default();
+        let vfs = Vfs::new_default()?;
         vfs.set_watch_enabled(self.watch);
 
         let session = ServeSession::new(vfs, project_path)?;
@@ -87,11 +87,16 @@ impl BuildCommand {
         write_model(&session, &output_path, output_kind)?;
 
         if self.watch {
-            let rt = Runtime::new().unwrap();
+            let rt = Runtime::new().context("Failed to start the async runtime for watch mode")?;
 
             loop {
                 let receiver = session.message_queue().subscribe(cursor);
-                let (new_cursor, _patch_set) = rt.block_on(receiver).unwrap();
+                let (new_cursor, _patch_set) = match rt.block_on(receiver) {
+                    Ok(message) => message,
+                    // The message queue was dropped, so there is nothing left
+                    // to watch. Stop watching gracefully.
+                    Err(_) => break,
+                };
                 cursor = new_cursor;
 
                 write_model(&session, &output_path, output_kind)?;

src/cli/fmt_project.rs

@@ -18,10 +18,10 @@ pub struct FmtProjectCommand {
 
 impl FmtProjectCommand {
     pub fn run(self) -> anyhow::Result<()> {
-        let vfs = Vfs::new_default();
+        let vfs = Vfs::new_default()?;
         vfs.set_watch_enabled(false);
 
-        let base_path = resolve_path(&self.project);
+        let base_path = resolve_path(&self.project)?;
         let project = Project::load_fuzzy(&vfs, &base_path)?
             .context("A project file is required to run 'rojo fmt-project'")?;
 

src/cli/init.rs

@@ -9,7 +9,7 @@ use std::{
     io::{self, Write},
 };
 
-use anyhow::{bail, format_err};
+use anyhow::{bail, format_err, Context};
 use clap::Parser;
 use fs_err as fs;
 use fs_err::OpenOptions;
@@ -42,9 +42,9 @@ pub struct InitCommand {
 
 impl InitCommand {
     pub fn run(self) -> anyhow::Result<()> {
-        let template = self.kind.template();
+        let template = self.kind.template()?;
 
-        let base_path = resolve_path(&self.path);
+        let base_path = resolve_path(&self.path)?;
         fs::create_dir_all(&base_path)?;
 
         let canonical = fs::canonicalize(&base_path)?;
@@ -128,7 +128,7 @@ pub enum InitKind {
 }
 
 impl InitKind {
-    fn template(&self) -> InMemoryFs {
+    fn template(&self) -> anyhow::Result<InMemoryFs> {
         let template_path = match self {
             Self::Place => "place",
             Self::Model => "model",
@@ -136,20 +136,24 @@ impl InitKind {
         };
 
         let snapshot: VfsSnapshot = bincode::deserialize(TEMPLATE_BINCODE)
-            .expect("Rojo's templates were not properly packed into Rojo's binary");
+            .context("Rojo's templates were not properly packed into Rojo's binary. This is a bug in Rojo; please file an issue.")?;
 
-        if let VfsSnapshot::Dir { mut children } = snapshot {
-            if let Some(template) = children.remove(template_path) {
-                let mut fs = InMemoryFs::new();
-                fs.load_snapshot("", template)
-                    .expect("loading a template in memory should never fail");
-                fs
-            } else {
-                panic!("template for project type {:?} is missing", self)
-            }
-        } else {
-            panic!("Rojo's templates were packed as a file instead of a directory")
-        }
+        let VfsSnapshot::Dir { mut children } = snapshot else {
+            bail!("Rojo's templates were packed as a file instead of a directory. This is a bug in Rojo; please file an issue.");
+        };
+
+        let template = children.remove(template_path).ok_or_else(|| {
+            format_err!(
+                "The template for project type {:?} is missing. This is a bug in Rojo; please file an issue.",
+                self
+            )
+        })?;
+
+        let mut fs = InMemoryFs::new();
+        fs.load_snapshot("", template)
+            .context("Failed to load Rojo's bundled template into memory")?;
+
+        Ok(fs)
     }
 }
 

src/cli/mod.rs

@@ -12,6 +12,7 @@ mod upload;
 
 use std::{borrow::Cow, env, path::Path, str::FromStr};
 
+use anyhow::Context;
 use clap::Parser;
 use thiserror::Error;
 
@@ -125,10 +126,14 @@ pub enum Subcommand {
     Syncback(SyncbackCommand),
 }
 
-pub(super) fn resolve_path(path: &Path) -> Cow<'_, Path> {
+pub(super) fn resolve_path(path: &Path) -> anyhow::Result<Cow<'_, Path>> {
     if path.is_absolute() {
-        Cow::Borrowed(path)
+        Ok(Cow::Borrowed(path))
     } else {
-        Cow::Owned(env::current_dir().unwrap().join(path))
+        let current_dir = env::current_dir().context(
+            "Could not determine the current working directory. \
+             It may have been deleted, or Rojo may not have permission to access it.",
+        )?;
+        Ok(Cow::Owned(current_dir.join(path)))
     }
 }

src/cli/plugin.rs

@@ -98,5 +98,5 @@ fn uninstall_plugin() -> anyhow::Result<()> {
 
 #[test]
 fn plugin_initialize() {
-    assert!(initialize_plugin().is_ok())
+    let _ = initialize_plugin().unwrap();
 }

src/cli/serve.rs

@@ -31,13 +31,21 @@ pub struct ServeCommand {
     /// it has none.
     #[clap(long)]
     pub port: Option<u16>,
+
+    /// Extra `Host`/`Origin` values the server will accept, beyond localhost and
+    /// the bind address (for example a hostname like `mypc.lan`). Repeat the
+    /// option or comma-separate to allow several. When given, this overrides the
+    /// project's `serveAllowedHosts`. Listing any host also turns on Host/Origin
+    /// validation for binds where it is otherwise off (such as `0.0.0.0`).
+    #[clap(long, value_delimiter = ',')]
+    pub allowed_hosts: Vec<String>,
 }
 
 impl ServeCommand {
     pub fn run(self, global: GlobalOptions) -> anyhow::Result<()> {
-        let project_path = resolve_path(&self.project);
+        let project_path = resolve_path(&self.project)?;
 
-        let vfs = Vfs::new_default();
+        let vfs = Vfs::new_default()?;
 
         let session = Arc::new(ServeSession::new(vfs, project_path)?);
 
@@ -51,10 +59,19 @@ impl ServeCommand {
             .or_else(|| session.project_port())
             .unwrap_or(DEFAULT_PORT);
 
+        // The CLI flag, when given, replaces the project's list rather than
+        // merging with it, matching how --address and --port override theirs.
+        let allowed_hosts = if self.allowed_hosts.is_empty() {
+            session.serve_allowed_hosts().to_vec()
+        } else {
+            self.allowed_hosts
+        };
+
         let server = LiveServer::new(session);
 
-        let _ = show_start_message(ip, port, global.color.into());
-        server.start((ip, port).into());
+        server.start((ip, port).into(), allowed_hosts, || {
+            let _ = show_start_message(ip, port, global.color.into());
+        })?;
 
         Ok(())
     }
@@ -86,6 +103,25 @@ fn show_start_message(bind_address: IpAddr, port: u16, color: ColorChoice) -> io
 
     writeln!(&mut buffer)?;
 
+    if !bind_address.is_loopback() {
+        let mut warning = ColorSpec::new();
+        warning.set_fg(Some(Color::Yellow)).set_bold(true);
+
+        buffer.set_color(&warning)?;
+        writeln!(
+            &mut buffer,
+            "WARNING: This server is bound to {address_string}, which is reachable from the \
+             network.\n\
+             The serve API is unauthenticated, so anyone who can reach {address_string}:{port} \
+             can read\n\
+             and modify your project's source. Prefer binding to localhost and tunneling (e.g. \
+             SSH,\n\
+             Tailscale, or WireGuard) when you need remote access."
+        )?;
+        buffer.set_color(&ColorSpec::new())?;
+        writeln!(&mut buffer)?;
+    }
+
     buffer.set_color(&ColorSpec::new())?;
     write!(&mut buffer, "Visit ")?;
 

src/cli/snapshots/librojo__cli__sourcemap__test__maps_absolute_paths.snap

@@ -0,0 +1,35 @@
+---
+source: src/cli/sourcemap.rs
+expression: sourcemap_contents
+---
+{
+  "name": "default",
+  "className": "DataModel",
+  "filePaths": "[...1 path omitted...]",
+  "children": [
+    {
+      "name": "ReplicatedStorage",
+      "className": "ReplicatedStorage",
+      "children": [
+        {
+          "name": "Project",
+          "className": "ModuleScript",
+          "filePaths": "[...1 path omitted...]",
+          "children": [
+            {
+              "name": "Module",
+              "className": "Folder",
+              "children": [
+                {
+                  "name": "module",
+                  "className": "ModuleScript",
+                  "filePaths": "[...1 path omitted...]"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

src/cli/snapshots/librojo__cli__sourcemap__test__maps_relative_paths.snap

@@ -0,0 +1,41 @@
+---
+source: src/cli/sourcemap.rs
+expression: sourcemap_contents
+---
+{
+  "name": "default",
+  "className": "DataModel",
+  "filePaths": [
+    "default.project.json"
+  ],
+  "children": [
+    {
+      "name": "ReplicatedStorage",
+      "className": "ReplicatedStorage",
+      "children": [
+        {
+          "name": "Project",
+          "className": "ModuleScript",
+          "filePaths": [
+            "src/init.luau"
+          ],
+          "children": [
+            {
+              "name": "Module",
+              "className": "Folder",
+              "children": [
+                {
+                  "name": "module",
+                  "className": "ModuleScript",
+                  "filePaths": [
+                    "../module/module.luau"
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

src/cli/sourcemap.rs

@@ -5,12 +5,13 @@ use std::{
     path::{self, Path, PathBuf},
 };
 
+use anyhow::Context;
 use clap::Parser;
 use fs_err::File;
 use memofs::Vfs;
 use rayon::prelude::*;
 use rbx_dom_weak::{types::Ref, Ustr};
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 use tokio::runtime::Runtime;
 
 use crate::{
@@ -24,19 +25,20 @@ const PATH_STRIP_FAILED_ERR: &str = "Failed to create relative paths for project
 const ABSOLUTE_PATH_FAILED_ERR: &str = "Failed to turn relative path into absolute path!";
 
 /// Representation of a node in the generated sourcemap tree.
-#[derive(Serialize)]
+#[derive(Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct SourcemapNode<'a> {
     name: &'a str,
     class_name: Ustr,
 
     #[serde(
+        default,
         skip_serializing_if = "Vec::is_empty",
         serialize_with = "crate::path_serializer::serialize_vec_absolute"
     )]
     file_paths: Vec<Cow<'a, Path>>,
 
-    #[serde(skip_serializing_if = "Vec::is_empty")]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
     children: Vec<SourcemapNode<'a>>,
 }
 
@@ -70,12 +72,13 @@ pub struct SourcemapCommand {
 
 impl SourcemapCommand {
     pub fn run(self) -> anyhow::Result<()> {
-        let project_path = resolve_path(&self.project);
+        let project_path = fs_err::canonicalize(resolve_path(&self.project)?)?;
 
-        log::trace!("Constructing in-memory filesystem");
-        let vfs = Vfs::new_default();
+        log::trace!("Constructing filesystem with StdBackend");
+        let vfs = Vfs::new_default()?;
         vfs.set_watch_enabled(self.watch);
 
+        log::trace!("Setting up session for sourcemap generation");
         let session = ServeSession::new(vfs, project_path)?;
         let mut cursor = session.message_queue().cursor();
 
@@ -87,19 +90,27 @@ impl SourcemapCommand {
 
         // Pre-build a rayon threadpool with a low number of threads to avoid
         // dynamic creation overhead on systems with a high number of cpus.
+        log::trace!("Setting rayon global threadpool");
         rayon::ThreadPoolBuilder::new()
             .num_threads(num_cpus::get().min(6))
             .build_global()
-            .unwrap();
+            .ok();
 
+        log::trace!("Writing initial sourcemap");
         write_sourcemap(&session, self.output.as_deref(), filter, self.absolute)?;
 
         if self.watch {
-            let rt = Runtime::new().unwrap();
+            log::trace!("Setting up runtime for watch mode");
+            let rt = Runtime::new().context("Failed to start the async runtime for watch mode")?;
 
             loop {
                 let receiver = session.message_queue().subscribe(cursor);
-                let (new_cursor, patch_set) = rt.block_on(receiver).unwrap();
+                let (new_cursor, patch_set) = match rt.block_on(receiver) {
+                    Ok(message) => message,
+                    // The message queue was dropped, so there is nothing left
+                    // to watch. Stop watching gracefully.
+                    Err(_) => break,
+                };
                 cursor = new_cursor;
 
                 if patch_set_affects_sourcemap(&session, &patch_set, filter) {
@@ -208,7 +219,7 @@ fn recurse_create_node<'a>(
     } else {
         for val in file_paths {
             output_file_paths.push(Cow::from(
-                val.strip_prefix(project_dir).expect(PATH_STRIP_FAILED_ERR),
+                pathdiff::diff_paths(val, project_dir).expect(PATH_STRIP_FAILED_ERR),
             ));
         }
     };
@@ -250,3 +261,80 @@ fn write_sourcemap(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod test {
+    use crate::cli::sourcemap::SourcemapNode;
+    use crate::cli::SourcemapCommand;
+    use insta::internals::Content;
+    use std::path::Path;
+
+    #[test]
+    fn maps_relative_paths() {
+        let sourcemap_dir = tempfile::tempdir().unwrap();
+        let sourcemap_output = sourcemap_dir.path().join("sourcemap.json");
+        let project_path = fs_err::canonicalize(
+            Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("test-projects")
+                .join("relative_paths")
+                .join("project"),
+        )
+        .unwrap();
+        let sourcemap_command = SourcemapCommand {
+            project: project_path,
+            output: Some(sourcemap_output.clone()),
+            include_non_scripts: false,
+            watch: false,
+            absolute: false,
+        };
+        assert!(sourcemap_command.run().is_ok());
+
+        let raw_sourcemap_contents = fs_err::read_to_string(sourcemap_output.as_path()).unwrap();
+        let sourcemap_contents =
+            serde_json::from_str::<SourcemapNode>(&raw_sourcemap_contents).unwrap();
+        insta::assert_json_snapshot!(sourcemap_contents);
+    }
+
+    #[test]
+    fn maps_absolute_paths() {
+        let sourcemap_dir = tempfile::tempdir().unwrap();
+        let sourcemap_output = sourcemap_dir.path().join("sourcemap.json");
+        let project_path = fs_err::canonicalize(
+            Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("test-projects")
+                .join("relative_paths")
+                .join("project"),
+        )
+        .unwrap();
+        let sourcemap_command = SourcemapCommand {
+            project: project_path,
+            output: Some(sourcemap_output.clone()),
+            include_non_scripts: false,
+            watch: false,
+            absolute: true,
+        };
+        assert!(sourcemap_command.run().is_ok());
+
+        let raw_sourcemap_contents = fs_err::read_to_string(sourcemap_output.as_path()).unwrap();
+        let sourcemap_contents =
+            serde_json::from_str::<SourcemapNode>(&raw_sourcemap_contents).unwrap();
+        insta::assert_json_snapshot!(sourcemap_contents, {
+            ".**.filePaths" => insta::dynamic_redaction(|mut value, _path| {
+                let mut paths_count = 0;
+
+                match value {
+                    Content::Seq(ref mut vec) => {
+                        for path in vec.iter().map(|i| i.as_str().unwrap()) {
+                            assert_eq!(fs_err::canonicalize(path).is_ok(), true, "path was not valid");
+                            assert_eq!(Path::new(path).is_absolute(), true, "path was not absolute");
+
+                            paths_count += 1;
+                        }
+                    }
+                    _ => panic!("Expected filePaths to be a sequence"),
+                }
+                format!("[...{} path{} omitted...]", paths_count, if paths_count != 1 { "s" } else { "" } )
+            })
+        });
+    }
+}

src/cli/syncback.rs

@@ -58,8 +58,8 @@ pub struct SyncbackCommand {
 
 impl SyncbackCommand {
     pub fn run(&self, global: GlobalOptions) -> anyhow::Result<()> {
-        let path_old = resolve_path(&self.project);
-        let path_new = resolve_path(&self.input);
+        let path_old = resolve_path(&self.project)?;
+        let path_new = resolve_path(&self.input)?;
 
         let input_kind = FileKind::from_path(&path_new).context(UNKNOWN_INPUT_KIND_ERR)?;
         let dom_start_timer = Instant::now();
@@ -69,7 +69,7 @@ impl SyncbackCommand {
             dom_start_timer.elapsed().as_secs_f32()
         );
 
-        let vfs = Vfs::new_default();
+        let vfs = Vfs::new_default()?;
         vfs.set_watch_enabled(false);
 
         let project_start_timer = Instant::now();

src/cli/upload.rs

@@ -38,9 +38,9 @@ pub struct UploadCommand {
 
 impl UploadCommand {
     pub fn run(self) -> Result<(), anyhow::Error> {
-        let project_path = resolve_path(&self.project);
+        let project_path = resolve_path(&self.project)?;
 
-        let vfs = Vfs::new_default();
+        let vfs = Vfs::new_default()?;
 
         let session = ServeSession::new(vfs, project_path)?;
 

src/glob.rs

@@ -48,3 +48,61 @@ impl<'de> Deserialize<'de> for Glob {
         Glob::new(&glob).map_err(D::Error::custom)
     }
 }
+
+/// A glob with optional gitignore-style negation. A leading `!` marks the
+/// pattern as a negation (re-includes paths that an earlier rule excluded).
+/// To match a literal `!` at the start of a pattern, escape it with `\!`.
+#[derive(Debug, Clone)]
+pub struct IgnorableGlob {
+    glob: Glob,
+    negated: bool,
+    raw: String,
+}
+
+impl IgnorableGlob {
+    pub fn new(pattern: &str) -> Result<Self, Error> {
+        let (negated, body) = if let Some(rest) = pattern.strip_prefix('!') {
+            (true, rest)
+        } else if pattern.starts_with(r"\!") {
+            (false, &pattern[1..])
+        } else {
+            (false, pattern)
+        };
+
+        Ok(IgnorableGlob {
+            glob: Glob::new(body)?,
+            negated,
+            raw: pattern.to_owned(),
+        })
+    }
+
+    pub fn is_match<P: AsRef<Path>>(&self, path: P) -> bool {
+        self.glob.is_match(path)
+    }
+
+    pub fn is_negation(&self) -> bool {
+        self.negated
+    }
+}
+
+impl PartialEq for IgnorableGlob {
+    fn eq(&self, other: &Self) -> bool {
+        self.negated == other.negated && self.glob == other.glob
+    }
+}
+
+impl Eq for IgnorableGlob {}
+
+impl Serialize for IgnorableGlob {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.raw)
+    }
+}
+
+impl<'de> Deserialize<'de> for IgnorableGlob {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let pattern = String::deserialize(deserializer)?;
+
+        IgnorableGlob::new(&pattern).map_err(D::Error::custom)
+    }
+}

src/project.rs

@@ -12,7 +12,8 @@ use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
 use crate::{
-    glob::Glob, json, resolution::UnresolvedValue, snapshot::SyncRule, syncback::SyncbackRules,
+    glob::IgnorableGlob, json, resolution::UnresolvedValue, snapshot::SyncRule,
+    syncback::SyncbackRules,
 };
 
 /// Represents 'default' project names that act as `init` files
@@ -105,6 +106,15 @@ pub struct Project {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub serve_address: Option<IpAddr>,
 
+    /// Additional `Host`/`Origin` header values that `rojo serve` will accept
+    /// beyond `localhost` and the bind address, such as a hostname like
+    /// `mypc.lan` used to reach a network-exposed server by name. Listing any
+    /// host also turns on `Host`/`Origin` validation for binds where it is
+    /// otherwise off (such as `0.0.0.0`). The `--allowed-hosts` CLI option
+    /// overrides this field when provided.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub serve_allowed_hosts: Vec<String>,
+
     /// Determines if Rojo should emit scripts with the appropriate `RunContext`
     /// for `*.client.lua` and `*.server.lua` files in the project instead of
     /// using `Script` and `LocalScript` Instances.
@@ -114,7 +124,7 @@ pub struct Project {
     /// A list of globs, relative to the folder the project file is in, that
     /// match files that should be excluded if Rojo encounters them.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub glob_ignore_paths: Vec<Glob>,
+    pub glob_ignore_paths: Vec<IgnorableGlob>,
 
     /// A list of rules for syncback with this project file.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -593,4 +603,90 @@ mod test {
         assert!(project.sync_rules[0].include.is_match("data.data.json"));
         assert!(project.sync_rules[1].include.is_match("init.module.lua"));
     }
+
+    #[test]
+    fn project_with_serve_allowed_hosts() {
+        let project_json = r#"{
+            "name": "TestProject",
+            "tree": { "$path": "src" },
+            "serveAllowedHosts": ["mypc.lan", "192.168.1.5"]
+        }"#;
+
+        let project = Project::load_from_slice(
+            project_json.as_bytes(),
+            PathBuf::from("/test/default.project.json"),
+            None,
+        )
+        .expect("Failed to parse project with serveAllowedHosts");
+
+        assert_eq!(project.serve_allowed_hosts, vec!["mypc.lan", "192.168.1.5"]);
+    }
+
+    #[test]
+    fn project_without_serve_allowed_hosts_defaults_to_empty() {
+        let project_json = r#"{
+            "name": "TestProject",
+            "tree": { "$path": "src" }
+        }"#;
+
+        let project = Project::load_from_slice(
+            project_json.as_bytes(),
+            PathBuf::from("/test/default.project.json"),
+            None,
+        )
+        .expect("Failed to parse project");
+
+        assert!(project.serve_allowed_hosts.is_empty());
+    }
+
+    #[test]
+    fn glob_ignore_paths_negation() {
+        let project_json = r#"{
+            "name": "TestProject",
+            "tree": { "$path": "src" },
+            "globIgnorePaths": [
+                "**/*.spec.lua",
+                "!keep.spec.lua",
+                "\\!literal.lua"
+            ]
+        }"#;
+
+        let project = Project::load_from_slice(
+            project_json.as_bytes(),
+            PathBuf::from("/test/default.project.json"),
+            None,
+        )
+        .expect("project should parse");
+
+        let paths = &project.glob_ignore_paths;
+        assert_eq!(paths.len(), 3);
+
+        assert!(!paths[0].is_negation());
+        assert!(paths[0].is_match("foo.spec.lua"));
+
+        assert!(paths[1].is_negation());
+        assert!(paths[1].is_match("keep.spec.lua"));
+
+        // `\!literal.lua` should match a file literally named `!literal.lua`,
+        // not be parsed as a negation.
+        assert!(!paths[2].is_negation());
+        assert!(paths[2].is_match("!literal.lua"));
+
+        let rules: Vec<_> = paths
+            .iter()
+            .map(|g| crate::snapshot::PathIgnoreRule {
+                base_path: PathBuf::from("/test"),
+                glob: g.clone(),
+            })
+            .collect();
+        assert!(crate::snapshot::is_path_ignored(
+            &rules,
+            "/test/foo.spec.lua"
+        ));
+        assert!(!crate::snapshot::is_path_ignored(
+            &rules,
+            "/test/keep.spec.lua"
+        ));
+        assert!(!crate::snapshot::is_path_ignored(&rules, "/test/plain.lua"));
+    }
 }

src/serve_session.rs

@@ -207,6 +207,10 @@ impl ServeSession {
         self.root_project.serve_address
     }
 
+    pub fn serve_allowed_hosts(&self) -> &[String] {
+        &self.root_project.serve_allowed_hosts
+    }
+
     pub fn root_dir(&self) -> &Path {
         self.root_project.folder_location()
     }

src/snapshot/metadata.rs

@@ -8,7 +8,7 @@ use anyhow::Context;
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    glob::Glob,
+    glob::{Glob, IgnorableGlob},
     path_serializer,
     project::ProjectNode,
     snapshot_middleware::{emit_legacy_scripts_default, Middleware},
@@ -70,12 +70,6 @@ pub struct InstanceMetadata {
     /// A schema provided via a JSON file, if one exists. Will be `None` for
     /// all non-JSON middleware.
     pub schema: Option<String>,
-
-    /// A custom name specified via meta.json or model.json files. If present,
-    /// this name will be used for the instance while the filesystem name will
-    /// be slugified to remove illegal characters.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub specified_name: Option<String>,
 }
 
 impl InstanceMetadata {
@@ -88,7 +82,6 @@ impl InstanceMetadata {
             specified_id: None,
             middleware: None,
             schema: None,
-            specified_name: None,
         }
     }
 
@@ -137,13 +130,6 @@ impl InstanceMetadata {
     pub fn schema(self, schema: Option<String>) -> Self {
         Self { schema, ..self }
     }
-
-    pub fn specified_name(self, specified_name: Option<String>) -> Self {
-        Self {
-            specified_name,
-            ..self
-        }
-    }
 }
 
 impl Default for InstanceMetadata {
@@ -236,18 +222,37 @@ pub struct PathIgnoreRule {
     pub base_path: PathBuf,
 
     /// The actual glob that can be matched against the input path.
-    pub glob: Glob,
+    pub glob: IgnorableGlob,
 }
 
 impl PathIgnoreRule {
-    pub fn passes<P: AsRef<Path>>(&self, path: P) -> bool {
+    pub fn matches<P: AsRef<Path>>(&self, path: P) -> bool {
         let path = path.as_ref();
 
         match path.strip_prefix(&self.base_path) {
-            Ok(suffix) => !self.glob.is_match(suffix),
-            Err(_) => true,
+            Ok(suffix) => self.glob.is_match(suffix),
+            Err(_) => false,
         }
     }
+
+    pub fn is_negation(&self) -> bool {
+        self.glob.is_negation()
+    }
+}
+
+/// Evaluates an ordered list of [`PathIgnoreRule`]s against a path using
+/// gitignore-style "last match wins" semantics: a path is ignored if the last
+/// rule whose pattern matches it is non-negated. Paths matched by no rule are
+/// not ignored.
+pub fn is_path_ignored<P: AsRef<Path>>(rules: &[PathIgnoreRule], path: P) -> bool {
+    let path = path.as_ref();
+    let mut ignored = false;
+    for rule in rules {
+        if rule.matches(path) {
+            ignored = !rule.is_negation();
+        }
+    }
+    ignored
 }
 
 /// Represents where a particular Instance or InstanceSnapshot came from.

src/snapshot/patch_compute.rs

@@ -8,7 +8,7 @@ use rbx_dom_weak::{
     ustr, HashMapExt as _, UstrMap, UstrSet,
 };
 
-use crate::{RojoRef, REF_POINTER_ATTRIBUTE_PREFIX};
+use crate::{variant_eq::variant_eq, RojoRef, REF_POINTER_ATTRIBUTE_PREFIX};
 
 use super::{
     patch::{PatchAdd, PatchSet, PatchUpdate},
@@ -127,7 +127,7 @@ fn compute_property_patches(
 
         match instance.properties().get(&name) {
             Some(instance_value) => {
-                if &snapshot_value != instance_value {
+                if !variant_eq(&snapshot_value, instance_value) {
                     changed_properties.insert(name, Some(snapshot_value));
                 }
             }

src/snapshot_middleware/csv.rs

@@ -195,7 +195,7 @@ struct LocalizationEntry<'a> {
 /// https://github.com/BurntSushi/rust-csv/issues/151
 ///
 /// This function operates in one step in order to minimize data-copying.
-fn convert_localization_csv(contents: &[u8]) -> Result<String, csv::Error> {
+fn convert_localization_csv(contents: &[u8]) -> anyhow::Result<String> {
     let mut reader = csv::Reader::from_reader(contents);
 
     let headers = reader.headers()?.clone();
@@ -237,7 +237,7 @@ fn convert_localization_csv(contents: &[u8]) -> Result<String, csv::Error> {
     }
 
     let encoded =
-        serde_json::to_string(&entries).expect("Could not encode JSON for localization table");
+        serde_json::to_string(&entries).context("Could not encode JSON for localization table")?;
 
     Ok(encoded)
 }

src/snapshot_middleware/dir.rs

@@ -7,7 +7,9 @@ use anyhow::Context;
 use memofs::{DirEntry, Vfs};
 
 use crate::{
-    snapshot::{InstanceContext, InstanceMetadata, InstanceSnapshot, InstigatingSource},
+    snapshot::{
+        is_path_ignored, InstanceContext, InstanceMetadata, InstanceSnapshot, InstigatingSource,
+    },
     syncback::{hash_instance, FsSnapshot, SyncbackReturn, SyncbackSnapshot},
 };
 
@@ -41,12 +43,8 @@ pub fn snapshot_dir_no_meta(
     path: &Path,
     name: &str,
 ) -> anyhow::Result<Option<InstanceSnapshot>> {
-    let passes_filter_rules = |child: &DirEntry| {
-        context
-            .path_ignore_rules
-            .iter()
-            .all(|rule| rule.passes(child.path()))
-    };
+    let passes_filter_rules =
+        |child: &DirEntry| !is_path_ignored(&context.path_ignore_rules, child.path());
 
     let mut snapshot_children = Vec::new();
 
@@ -74,6 +72,8 @@ pub fn snapshot_dir_no_meta(
         normalized_path.join("init.server.luau"),
         normalized_path.join("init.client.lua"),
         normalized_path.join("init.client.luau"),
+        normalized_path.join("init.plugin.lua"),
+        normalized_path.join("init.plugin.luau"),
         normalized_path.join("init.csv"),
     ];
 

src/snapshot_middleware/json_model.rs

@@ -35,14 +35,20 @@ pub fn snapshot_json_model(
         format!("File is not a valid JSON model: {}", path.display())
     })?;
 
-    // If the JSON has a name property, preserve it in metadata for syncback
-    let specified_name = instance.name.clone();
+    if let Some(top_level_name) = &instance.name {
+        let new_name = format!("{}.model.json", top_level_name);
 
-    // Use the name from JSON if present, otherwise fall back to filename-derived name
-    if instance.name.is_none() {
-        instance.name = Some(name.to_owned());
+        log::warn!(
+            "Model at path {} had a top-level Name field. \
+            This field has been ignored since Rojo 6.0.\n\
+            Consider removing this field and renaming the file to {}.",
+            new_name,
+            path.display()
+        );
     }
 
+    instance.name = Some(name.to_owned());
+
     let id = instance.id.take().map(RojoRef::new);
     let schema = instance.schema.take();
 
@@ -56,8 +62,7 @@ pub fn snapshot_json_model(
         .relevant_paths(vec![vfs.canonicalize(path)?])
         .context(context)
         .specified_id(id)
-        .schema(schema)
-        .specified_name(specified_name);
+        .schema(schema);
 
     Ok(Some(snapshot))
 }
@@ -76,7 +81,6 @@ pub fn syncback_json_model<'sync>(
         // schemas will ever exist in one project for it to matter, but it
         // could have a performance cost.
         model.schema = old_inst.metadata().schema.clone();
-        model.name = old_inst.metadata().specified_name.clone();
     }
 
     Ok(SyncbackReturn {

src/snapshot_middleware/lua.rs

@@ -158,16 +158,8 @@ pub fn syncback_lua<'sync>(
 
         if !meta.is_empty() {
             let parent_location = snapshot.path.parent_err()?;
-            let instance_name = &snapshot.new_inst().name;
-            let slugified;
-            let meta_name = if crate::syncback::validate_file_name(instance_name).is_err() {
-                slugified = crate::syncback::slugify_name(instance_name);
-                &slugified
-            } else {
-                instance_name
-            };
             fs_snapshot.add_file(
-                parent_location.join(format!("{}.meta.json", meta_name)),
+                parent_location.join(format!("{}.meta.json", new_inst.name)),
                 serde_json::to_vec_pretty(&meta).context("cannot serialize metadata")?,
             );
         }
@@ -190,6 +182,7 @@ pub fn syncback_lua_init<'sync>(
         ScriptType::Server => "init.server.luau",
         ScriptType::Client => "init.client.luau",
         ScriptType::Module => "init.luau",
+        ScriptType::Plugin => "init.plugin.luau",
         _ => anyhow::bail!("syncback is not yet implemented for {script_type:?}"),
     });
 

src/snapshot_middleware/meta_file.rs

@@ -10,10 +10,7 @@ use rbx_dom_weak::{
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    json,
-    resolution::UnresolvedValue,
-    snapshot::InstanceSnapshot,
-    syncback::{validate_file_name, SyncbackSnapshot},
+    json, resolution::UnresolvedValue, snapshot::InstanceSnapshot, syncback::SyncbackSnapshot,
     RojoRef,
 };
 
@@ -39,9 +36,6 @@ pub struct AdjacentMetadata {
     #[serde(default, skip_serializing_if = "IndexMap::is_empty")]
     pub attributes: IndexMap<String, UnresolvedValue>,
 
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-
     #[serde(skip)]
     pub path: PathBuf,
 }
@@ -150,24 +144,6 @@ impl AdjacentMetadata {
             }
         }
 
-        let name = snapshot
-            .old_inst()
-            .and_then(|inst| inst.metadata().specified_name.clone())
-            .or_else(|| {
-                // If this is a new instance and its name is invalid for the filesystem,
-                // we need to specify the name in meta.json so it can be preserved
-                if snapshot.old_inst().is_none() {
-                    let instance_name = &snapshot.new_inst().name;
-                    if validate_file_name(instance_name).is_err() {
-                        Some(instance_name.clone())
-                    } else {
-                        None
-                    }
-                } else {
-                    None
-                }
-            });
-
         Ok(Some(Self {
             ignore_unknown_instances: if ignore_unknown_instances {
                 Some(true)
@@ -179,7 +155,6 @@ impl AdjacentMetadata {
             path,
             id: None,
             schema,
-            name,
         }))
     }
 
@@ -238,26 +213,11 @@ impl AdjacentMetadata {
         Ok(())
     }
 
-    fn apply_name(&mut self, snapshot: &mut InstanceSnapshot) -> anyhow::Result<()> {
-        if self.name.is_some() && snapshot.metadata.specified_name.is_some() {
-            anyhow::bail!(
-                "cannot specify a name using {} (instance has a name from somewhere else)",
-                self.path.display()
-            );
-        }
-        if let Some(name) = &self.name {
-            snapshot.name = name.clone().into();
-        }
-        snapshot.metadata.specified_name = self.name.take();
-        Ok(())
-    }
-
     pub fn apply_all(&mut self, snapshot: &mut InstanceSnapshot) -> anyhow::Result<()> {
         self.apply_ignore_unknown_instances(snapshot);
         self.apply_properties(snapshot)?;
         self.apply_id(snapshot)?;
         self.apply_schema(snapshot)?;
-        self.apply_name(snapshot)?;
         Ok(())
     }
 
@@ -266,13 +226,11 @@ impl AdjacentMetadata {
     ///
     /// - The number of properties and attributes is 0
     /// - `ignore_unknown_instances` is None
-    /// - `name` is None
     #[inline]
     pub fn is_empty(&self) -> bool {
         self.attributes.is_empty()
             && self.properties.is_empty()
             && self.ignore_unknown_instances.is_none()
-            && self.name.is_none()
     }
 
     // TODO: Add method to allow selectively applying parts of metadata and
@@ -304,9 +262,6 @@ pub struct DirectoryMetadata {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub class_name: Option<Ustr>,
 
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-
     #[serde(skip)]
     pub path: PathBuf,
 }
@@ -417,24 +372,6 @@ impl DirectoryMetadata {
             }
         }
 
-        let name = snapshot
-            .old_inst()
-            .and_then(|inst| inst.metadata().specified_name.clone())
-            .or_else(|| {
-                // If this is a new instance and its name is invalid for the filesystem,
-                // we need to specify the name in meta.json so it can be preserved
-                if snapshot.old_inst().is_none() {
-                    let instance_name = &snapshot.new_inst().name;
-                    if validate_file_name(instance_name).is_err() {
-                        Some(instance_name.clone())
-                    } else {
-                        None
-                    }
-                } else {
-                    None
-                }
-            });
-
         Ok(Some(Self {
             ignore_unknown_instances: if ignore_unknown_instances {
                 Some(true)
@@ -447,7 +384,6 @@ impl DirectoryMetadata {
             path,
             id: None,
             schema,
-            name,
         }))
     }
 
@@ -457,7 +393,6 @@ impl DirectoryMetadata {
         self.apply_properties(snapshot)?;
         self.apply_id(snapshot)?;
         self.apply_schema(snapshot)?;
-        self.apply_name(snapshot)?;
 
         Ok(())
     }
@@ -529,33 +464,17 @@ impl DirectoryMetadata {
         snapshot.metadata.schema = self.schema.take();
         Ok(())
     }
-
-    fn apply_name(&mut self, snapshot: &mut InstanceSnapshot) -> anyhow::Result<()> {
-        if self.name.is_some() && snapshot.metadata.specified_name.is_some() {
-            anyhow::bail!(
-                "cannot specify a name using {} (instance has a name from somewhere else)",
-                self.path.display()
-            );
-        }
-        if let Some(name) = &self.name {
-            snapshot.name = name.clone().into();
-        }
-        snapshot.metadata.specified_name = self.name.take();
-        Ok(())
-    }
     /// Returns whether the metadata is 'empty', meaning it doesn't have anything
     /// worth persisting in it. Specifically:
     ///
     /// - The number of properties and attributes is 0
     /// - `ignore_unknown_instances` is None
     /// - `class_name` is either None or not Some("Folder")
-    /// - `name` is None
     #[inline]
     pub fn is_empty(&self) -> bool {
         self.attributes.is_empty()
             && self.properties.is_empty()
             && self.ignore_unknown_instances.is_none()
-            && self.name.is_none()
             && if let Some(class) = &self.class_name {
                 class == "Folder"
             } else {

src/snapshot_middleware/mod.rs

@@ -91,7 +91,9 @@ pub fn snapshot_from_vfs(
         // TODO: Is this even necessary anymore?
         match file_name {
             "init.server.luau" | "init.server.lua" | "init.client.luau" | "init.client.lua"
-            | "init.luau" | "init.lua" | "init.csv" => return Ok(None),
+            | "init.plugin.luau" | "init.plugin.lua" | "init.luau" | "init.lua" | "init.csv" => {
+                return Ok(None)
+            }
             _ => {}
         }
 
@@ -124,6 +126,8 @@ fn get_dir_middleware<'path>(
             (Middleware::ServerScriptDir, "init.server.lua"),
             (Middleware::ClientScriptDir, "init.client.luau"),
             (Middleware::ClientScriptDir, "init.client.lua"),
+            (Middleware::PluginScriptDir, "init.plugin.lua"),
+            (Middleware::PluginScriptDir, "init.plugin.luau"),
             (Middleware::CsvDir, "init.csv"),
         ]
     });
@@ -205,6 +209,8 @@ pub enum Middleware {
     #[serde(skip_deserializing)]
     ClientScriptDir,
     #[serde(skip_deserializing)]
+    PluginScriptDir,
+    #[serde(skip_deserializing)]
     ModuleScriptDir,
     #[serde(skip_deserializing)]
     CsvDir,
@@ -255,6 +261,9 @@ impl Middleware {
             Self::ClientScriptDir => {
                 snapshot_lua_init(context, vfs, path, name, ScriptType::Client)
             }
+            Self::PluginScriptDir => {
+                snapshot_lua_init(context, vfs, path, name, ScriptType::Plugin)
+            }
             Self::ModuleScriptDir => {
                 snapshot_lua_init(context, vfs, path, name, ScriptType::Module)
             }
@@ -297,6 +306,7 @@ impl Middleware {
             Middleware::Dir => syncback_dir(snapshot),
             Middleware::ServerScriptDir => syncback_lua_init(ScriptType::Server, snapshot),
             Middleware::ClientScriptDir => syncback_lua_init(ScriptType::Client, snapshot),
+            Middleware::PluginScriptDir => syncback_lua_init(ScriptType::Plugin, snapshot),
             Middleware::ModuleScriptDir => syncback_lua_init(ScriptType::Module, snapshot),
             Middleware::CsvDir => syncback_csv_init(snapshot),
 
@@ -318,6 +328,7 @@ impl Middleware {
             Middleware::Dir
                 | Middleware::ServerScriptDir
                 | Middleware::ClientScriptDir
+                | Middleware::PluginScriptDir
                 | Middleware::ModuleScriptDir
                 | Middleware::CsvDir
         )

src/snapshot_middleware/project.rs

@@ -344,6 +344,11 @@ pub fn syncback_project<'sync>(
     let mut new_child_map = HashMap::new();
 
     let mut node_changed_map = Vec::new();
+    // Tracks whether any stale default-valued properties were removed from
+    // project nodes. If so, we must reserialize even if
+    // project_node_should_reserialize wouldn't otherwise detect a change
+    // (it only compares node properties forward, not in reverse).
+    let mut removed_stale_properties = false;
     let mut node_queue = VecDeque::with_capacity(1);
     node_queue.push_back((&mut project.tree, old_inst, snapshot.new_inst()));
 
@@ -402,10 +407,12 @@ pub fn syncback_project<'sync>(
 
             // We only want to set properties if it needs it.
             if !middleware.handles_own_properties() {
-                project_node_property_syncback_path(snapshot, new_inst, node);
+                removed_stale_properties |=
+                    project_node_property_syncback_path(snapshot, new_inst, node);
             }
         } else {
-            project_node_property_syncback_no_path(snapshot, new_inst, node);
+            removed_stale_properties |=
+                project_node_property_syncback_no_path(snapshot, new_inst, node);
         }
 
         for child_ref in new_inst.children() {
@@ -507,12 +514,18 @@ pub fn syncback_project<'sync>(
     }
     let mut fs_snapshot = FsSnapshot::new();
 
-    for (node_properties, node_attributes, old_inst) in node_changed_map {
-        if project_node_should_reserialize(node_properties, node_attributes, old_inst)? {
-            fs_snapshot.add_file(project_path, serde_json::to_vec_pretty(&project)?);
-            break;
+    let mut needs_reserialize = removed_stale_properties;
+    if !needs_reserialize {
+        for (node_properties, node_attributes, old_inst) in node_changed_map {
+            if project_node_should_reserialize(node_properties, node_attributes, old_inst)? {
+                needs_reserialize = true;
+                break;
+            }
         }
     }
+    if needs_reserialize {
+        fs_snapshot.add_file(project_path, serde_json::to_vec_pretty(&project)?);
+    }
 
     Ok(SyncbackReturn {
         fs_snapshot,
@@ -521,15 +534,18 @@ pub fn syncback_project<'sync>(
     })
 }
 
+/// Syncs properties from the new instance into the project node.
+/// Returns `true` if any stale properties were removed (i.e. properties
+/// that existed in the project node but are now at their engine default).
 fn project_node_property_syncback(
     _snapshot: &SyncbackSnapshot,
     filtered_properties: UstrMap<&Variant>,
     new_inst: &Instance,
     node: &mut ProjectNode,
-) {
+) -> bool {
     let properties = &mut node.properties;
     let mut attributes = BTreeMap::new();
-    for (name, value) in filtered_properties {
+    for (&name, &value) in &filtered_properties {
         match value {
             Variant::Attributes(attrs) => {
                 for (attr_name, attr_value) in attrs.iter() {
@@ -552,14 +568,48 @@ fn project_node_property_syncback(
             }
         }
     }
+
+    // Remove stale properties: entries that exist in the project node's
+    // $properties but are no longer in the filtered (non-default) properties
+    // from the instance. This handles the case where Studio resets a property
+    // to its engine default — filter_properties won't include it, so we need
+    // to clean up the now-stale project entry.
+    let class_data = rbx_reflection_database::get()
+        .ok()
+        .and_then(|db| db.classes.get(new_inst.class.as_str()));
+    let len_before = properties.len();
+    properties.retain(|prop_name, _| {
+        if filtered_properties.contains_key(prop_name) {
+            return true;
+        }
+        // Only remove if the property has a known default value in the
+        // reflection database. If there's no default, the property might be
+        // absent from the instance for other reasons (e.g. unknown property),
+        // so we conservatively keep it.
+        if let Some(data) = &class_data {
+            if data.default_properties.contains_key(prop_name.as_str()) {
+                log::debug!(
+                    "Removing stale property '{}' from project node for class '{}': \
+                     value has been reset to engine default",
+                    prop_name,
+                    new_inst.class
+                );
+                return false;
+            }
+        }
+        true
+    });
+    let removed_stale = properties.len() < len_before;
+
     node.attributes = attributes;
+    removed_stale
 }
 
 fn project_node_property_syncback_path(
     snapshot: &SyncbackSnapshot,
     new_inst: &Instance,
     node: &mut ProjectNode,
-) {
+) -> bool {
     let filtered_properties = snapshot
         .get_path_filtered_properties(new_inst.referent())
         .unwrap();
@@ -570,7 +620,7 @@ fn project_node_property_syncback_no_path(
     snapshot: &SyncbackSnapshot,
     new_inst: &Instance,
     node: &mut ProjectNode,
-) {
+) -> bool {
     let filtered_properties = filter_properties(snapshot.project(), new_inst);
     project_node_property_syncback(snapshot, filtered_properties, new_inst, node)
 }

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__csv__test__csv_init.snap

@@ -15,6 +15,8 @@ metadata:
     - /root/init.server.luau
     - /root/init.client.lua
     - /root/init.client.luau
+    - /root/init.plugin.lua
+    - /root/init.plugin.luau
     - /root/init.csv
     - /root/init.meta.json
     - /root/init.meta.jsonc

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__csv__test__csv_init_with_meta.snap

@@ -15,6 +15,8 @@ metadata:
     - /root/init.server.luau
     - /root/init.client.lua
     - /root/init.client.luau
+    - /root/init.plugin.lua
+    - /root/init.plugin.luau
     - /root/init.csv
     - /root/init.meta.json
     - /root/init.meta.jsonc

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__dir__test__empty_folder.snap

@@ -15,6 +15,8 @@ metadata:
     - /foo/init.server.luau
     - /foo/init.client.lua
     - /foo/init.client.luau
+    - /foo/init.plugin.lua
+    - /foo/init.plugin.luau
     - /foo/init.csv
     - /foo/init.meta.json
     - /foo/init.meta.jsonc

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__dir__test__folder_in_folder.snap

@@ -15,6 +15,8 @@ metadata:
     - /foo/init.server.luau
     - /foo/init.client.lua
     - /foo/init.client.luau
+    - /foo/init.plugin.lua
+    - /foo/init.plugin.luau
     - /foo/init.csv
     - /foo/init.meta.json
     - /foo/init.meta.jsonc
@@ -40,6 +42,8 @@ children:
         - /foo/Child/init.server.luau
         - /foo/Child/init.client.lua
         - /foo/Child/init.client.luau
+        - /foo/Child/init.plugin.lua
+        - /foo/Child/init.plugin.luau
         - /foo/Child/init.csv
         - /foo/Child/init.meta.json
         - /foo/Child/init.meta.jsonc

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__lua__test__init_module_from_vfs.snap

@@ -15,6 +15,8 @@ metadata:
     - /root/init.server.luau
     - /root/init.client.lua
     - /root/init.client.luau
+    - /root/init.plugin.lua
+    - /root/init.plugin.luau
     - /root/init.csv
     - /root/init.meta.json
     - /root/init.meta.jsonc

src/snapshot_middleware/snapshots/librojo__snapshot_middleware__lua__test__init_module_from_vfs_with_meta.snap

@@ -15,6 +15,8 @@ metadata:
     - /root/init.server.luau
     - /root/init.client.lua
     - /root/init.client.luau
+    - /root/init.plugin.lua
+    - /root/init.plugin.luau
     - /root/init.csv
     - /root/init.meta.json
     - /root/init.meta.jsonc

src/syncback/file_names.rs

@@ -8,11 +8,11 @@ use rbx_dom_weak::Instance;
 
 use crate::{snapshot::InstanceWithMeta, snapshot_middleware::Middleware};
 
-pub fn name_for_inst<'a>(
+pub fn name_for_inst<'old>(
     middleware: Middleware,
-    new_inst: &'a Instance,
-    old_inst: Option<InstanceWithMeta<'a>>,
-) -> anyhow::Result<Cow<'a, str>> {
+    new_inst: &Instance,
+    old_inst: Option<InstanceWithMeta<'old>>,
+) -> anyhow::Result<Cow<'old, str>> {
     if let Some(old_inst) = old_inst {
         if let Some(source) = old_inst.metadata().relevant_paths.first() {
             source
@@ -35,24 +35,15 @@ pub fn name_for_inst<'a>(
             | Middleware::CsvDir
             | Middleware::ServerScriptDir
             | Middleware::ClientScriptDir
-            | Middleware::ModuleScriptDir => {
-                if validate_file_name(&new_inst.name).is_err() {
-                    Cow::Owned(slugify_name(&new_inst.name))
-                } else {
-                    Cow::Borrowed(&new_inst.name)
-                }
-            }
+            | Middleware::PluginScriptDir
+            | Middleware::ModuleScriptDir => Cow::Owned(new_inst.name.clone()),
             _ => {
                 let extension = extension_for_middleware(middleware);
-                let slugified;
-                let final_name = if validate_file_name(&new_inst.name).is_err() {
-                    slugified = slugify_name(&new_inst.name);
-                    &slugified
-                } else {
-                    &new_inst.name
-                };
-
-                Cow::Owned(format!("{final_name}.{extension}"))
+                let name = &new_inst.name;
+                validate_file_name(name).with_context(|| {
+                    format!("name '{name}' is not legal to write to the file system")
+                })?;
+                Cow::Owned(format!("{name}.{extension}"))
             }
         })
     }
@@ -88,6 +79,7 @@ pub fn extension_for_middleware(middleware: Middleware) -> &'static str {
         | Middleware::CsvDir
         | Middleware::ServerScriptDir
         | Middleware::ClientScriptDir
+        | Middleware::PluginScriptDir
         | Middleware::ModuleScriptDir => {
             unimplemented!("directory middleware requires special treatment")
         }
@@ -104,39 +96,6 @@ const INVALID_WINDOWS_NAMES: [&str; 22] = [
 /// in a file's name.
 const FORBIDDEN_CHARS: [char; 9] = ['<', '>', ':', '"', '/', '|', '?', '*', '\\'];
 
-/// Slugifies a name by replacing forbidden characters with underscores
-/// and ensuring the result is a valid file name
-pub fn slugify_name(name: &str) -> String {
-    let mut result = String::with_capacity(name.len());
-
-    for ch in name.chars() {
-        if FORBIDDEN_CHARS.contains(&ch) {
-            result.push('_');
-        } else {
-            result.push(ch);
-        }
-    }
-
-    // Handle Windows reserved names by appending an underscore
-    let result_lower = result.to_lowercase();
-    for forbidden in INVALID_WINDOWS_NAMES {
-        if result_lower == forbidden.to_lowercase() {
-            result.push('_');
-            break;
-        }
-    }
-
-    while result.ends_with(' ') || result.ends_with('.') {
-        result.pop();
-    }
-
-    if result.is_empty() || result.chars().all(|c| c == '_') {
-        result = "instance".to_string();
-    }
-
-    result
-}
-
 /// Validates a provided file name to ensure it's allowed on the file system. An
 /// error is returned if the name isn't allowed, indicating why.
 /// This takes into account rules for Windows, MacOS, and Linux.